References for product rhel6

• anssi
• NT007(R02)
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• NT007(R03)
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• NT007(R1)
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• NT007(R17)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• NT012(R03)
• package_ntp_installedInstall the ntp service
• service_ntp_enabledEnable the NTP Daemon
• NT12(R18)
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• NT12(R5)
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• NT28(R08)
• security_patches_up_to_dateEnsure Software Patches Installed
• NT28(R1)
• package_dhcp_removedUninstall DHCP Server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnetd_removedUninstall the telnet server
• NT28(R11)
• grub2_enable_iommu_forceIOMMU configuration directive
• NT28(R12)
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_noexecAdd noexec Option to /var/tmp
• mount_option_var_tmp_nosuidAdd nosuid Option to /var/tmp
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_srvEnsure /srv Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• NT28(R13)
• file_permissions_systemmapVerify that local System.map file (if exists) is readable only by root
• NT28(R15)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• NT28(R17)
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• NT28(R19)
• no_direct_root_loginsDirect root Logins Not Allowed
• sshd_disable_root_loginDisable SSH Root Login
• NT28(R22)
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• NT28(R23)
• sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
• sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• NT28(R25)
• sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes
• NT28(R29)
• accounts_tmoutSet Interactive Session Timeout
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• NT28(R32)
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• NT28(R35)
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• NT28(R36)
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_shadowVerify Permissions on shadow File
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• NT28(R37)
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• NT28(R38)
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• NT28(R4)
• selinux_stateEnsure SELinux State is Enforcing
• NT28(R43)
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• NT28(R46)
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• NT28(R47)
• partition_for_var_logEnsure /var/log Located On Separate Partition
• NT28(R5)
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• NT28(R50)
• package_audit_installedEnsure the audit Subsystem is Installed
• package_cron_installedInstall the cron service
• NT28(R51)
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• package_aide_installedInstall AIDE
• NT28(R59)
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• NT28(R66)
• selinux_policytypeConfigure SELinux Policy
• NT28(R68)
• package_setroubleshoot_removedUninstall setroubleshoot Package
• NT28(R7)
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• cidss
• Req-8.1.7
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• cis
• 1.1.1.2
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• 1.1.1.3
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• 1.1.1.4
• kernel_module_hfs_disabledDisable Mounting of hfs
• 1.1.1.5
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• 1.1.11
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• 1.1.6
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• 1.2.6
• rpm_verify_hashesVerify File Hashes with RPM
• 1.4.3
• require_singleuser_authRequire Authentication for Single User Mode
• 1.5.2
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• 1.5.4
• disable_prelinkDisable Prelinking
• 1.6.1
• sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
• sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
• 1.7.1.5
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• 2.1.1
• package_telnet-server_removedUninstall telnet-server Package
• 2.1.6
• service_tftp_disabledDisable tftp Service
• 2.1.7
• service_xinetd_disabledDisable xinetd Service
• 2.2.13
• service_squid_disabledDisable Squid
• 2.2.16
• package_ypserv_removedUninstall ypserv Package
• 2.2.17
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• 2.2.18
• service_telnet_disabledDisable telnet Service
• 2.2.21
• package_talk-server_removedUninstall talk-server Package
• 2.3.2
• package_rsh_removedUninstall rsh Package
• 2.3.3
• package_talk_removedUninstall talk Package
• 3.2.3
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• 4.1.1
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• 4.1.18
• audit_rules_immutableMake the auditd Configuration Immutable
• 4.2.1.5
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• 4.4.1.1
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• 4.4.1.2
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• 5.1.1
• package_syslogng_installedEnsure syslog-ng is Installed
• 5.1.2
• service_syslogng_enabledEnable syslog-ng Service
• 5.2.10
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 5.2.12
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• 5.2.13
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• 5.2.14
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• 5.2.17
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• 5.2.2
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• 5.2.5
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• 5.2.8
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• 5.3.2
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• 5.3.3
• accounts_password_pam_unix_rememberLimit Password Reuse
• 5.4.2
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• 5.4.4
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• 6.3.1
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• cis-csc
• 1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_users_coredumpsDisable Core Dumps for All Users
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 11
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 12
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_users_coredumpsDisable Core Dumps for All Users
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 13
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_prelinkDisable Prelinking
• disable_users_coredumpsDisable Core Dumps for All Users
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• 14
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• encrypt_partitionsEncrypt Partitions
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_ntp_installedInstall the ntp service
• package_openldap-servers_removedUninstall openldap-servers Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_sendmail_removedUninstall Sendmail Package
• package_syslogng_installedEnsure syslog-ng is Installed
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_network_listening_disabledDisable Postfix Network Listening
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 15
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_users_coredumpsDisable Core Dumps for All Users
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• package_syslogng_installedEnsure syslog-ng is Installed
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 16
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_users_coredumpsDisable Core Dumps for All Users
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 18
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• root_path_defaultRoot Path Must Be Vendor Default
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• security_patches_up_to_dateEnsure Software Patches Installed
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 19
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• 2
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• disable_prelinkDisable Prelinking
• disable_users_coredumpsDisable Core Dumps for All Users
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rpm_verify_hashesVerify File Hashes with RPM
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• 20
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• 3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_ntp_installedInstall the ntp service
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_sendmail_removedUninstall Sendmail Package
• package_syslogng_installedEnsure syslog-ng is Installed
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_network_listening_disabledDisable Postfix Network Listening
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• install_antivirusInstall Virus Scanning Software
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• security_patches_up_to_dateEnsure Software Patches Installed
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 5
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_libreswan_installedInstall libreswan Package
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_sssd_installedInstall the SSSD Package
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 6
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 7
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_users_coredumpsDisable Core Dumps for All Users
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• postfix_server_bannerConfigure SMTP Greeting Banner
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• 8
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_users_coredumpsDisable Core Dumps for All Users
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• 9
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• cjis
• 5.10.1
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_sctp_disabledDisable SCTP Support
• 5.10.1.1
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• 5.10.1.2
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• 5.10.1.3
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• package_aide_installedInstall AIDE
• 5.10.4.1
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• security_patches_up_to_dateEnsure Software Patches Installed
• 5.13.1.3
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• 5.4.1.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• service_auditd_enabledEnable auditd Service
• 5.5.2
• account_unique_nameEnsure All Accounts on the System Have Unique Names
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• 5.5.2.2
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• 5.5.3
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• 5.5.6
• disable_host_authDisable Host-Based Authentication
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 5.6.2.1
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• 5.6.2.1.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_password_pam_unix_rememberLimit Password Reuse
• 5.6.2.2
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• cobit5
• APO01.06
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_aide_installedInstall AIDE
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• APO08.04
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• APO10.01
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• APO10.03
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• APO10.04
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• APO10.05
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• APO11.04
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• APO11.06
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• APO12.01
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• APO12.02
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• APO12.03
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• APO12.04
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• APO12.06
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• service_auditd_enabledEnable auditd Service
• APO13.01
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• disable_users_coredumpsDisable Core Dumps for All Users
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• root_path_defaultRoot Path Must Be Vendor Default
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• APO13.02
• install_antivirusInstall Virus Scanning Software
• BAI01.06
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• package_aide_installedInstall AIDE
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• BAI02.01
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• BAI03.01
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• BAI03.02
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• BAI03.03
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• BAI03.05
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• BAI03.08
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• BAI03.10
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• security_patches_up_to_dateEnsure Software Patches Installed
• BAI04.04
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• disable_users_coredumpsDisable Core Dumps for All Users
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• BAI06.01
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• BAI07.04
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• BAI08.02
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• BAI09.01
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• BAI09.02
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• BAI09.03
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• BAI10.01
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• BAI10.02
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• BAI10.03
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• BAI10.05
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• DSS01.03
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• disable_users_coredumpsDisable Core Dumps for All Users
• install_hidsInstall Intrusion Detection Software
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• DSS01.04
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• DSS01.05
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• install_hidsInstall Intrusion Detection Software
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• DSS02.02
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• DSS02.04
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• DSS02.05
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• DSS02.07
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• DSS03.01
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• DSS03.05
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• disable_users_coredumpsDisable Core Dumps for All Users
• install_hidsInstall Intrusion Detection Software
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• DSS04.05
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• DSS04.07
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• DSS05.01
• install_antivirusInstall Virus Scanning Software
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• DSS05.02
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• security_patches_up_to_dateEnsure Software Patches Installed
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• DSS05.03
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• install_antivirusInstall Virus Scanning Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• DSS05.04
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• encrypt_partitionsEncrypt Partitions
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_libreswan_installedInstall libreswan Package
• package_ntp_installedInstall the ntp service
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• DSS05.05
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• DSS05.06
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• DSS05.07
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dhcp_server_configure_loggingConfigure Logging
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_users_coredumpsDisable Core Dumps for All Users
• encrypt_partitionsEncrypt Partitions
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_ntp_installedInstall the ntp service
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_sssd_installedInstall the SSSD Package
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• DSS05.10
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• DSS06.02
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_aide_installedInstall AIDE
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• DSS06.03
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• disable_host_authDisable Host-Based Authentication
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_nfs_disabledDisable Network File System (nfs)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• DSS06.06
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• encrypt_partitionsEncrypt Partitions
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_antivirusInstall Virus Scanning Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• DSS06.10
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• MEA01.01
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• MEA01.02
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• MEA01.03
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• MEA01.04
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• MEA01.05
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• MEA02.01
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• cui
• 3.1.1
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• 3.1.10
• package_screen_installedInstall the screen Package
• 3.1.11
• accounts_tmoutSet Interactive Session Timeout
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• 3.1.12
• disable_host_authDisable Host-Based Authentication
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_priv_separationEnable Use of Privilege Separation
• 3.1.13
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• package_rsh_removedUninstall rsh Package
• package_telnet_removedRemove telnet Clients
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• 3.1.16
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• service_bluetooth_disabledDisable Bluetooth Service
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• 3.1.2
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• 3.1.20
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_ipv6_privacy_extensionsUse Privacy Extensions for Address
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 3.1.21
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• 3.1.5
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• 3.1.6
• no_direct_root_loginsDirect root Logins Not Allowed
• 3.1.7
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 3.1.8
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• 3.1.9
• banner_etc_issueModify the System Login Banner
• sshd_enable_warning_bannerEnable SSH Warning Banner
• 3.13.10
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• 3.13.11
• disable_prelinkDisable Prelinking
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• 3.13.16
• encrypt_partitionsEncrypt Partitions
• 3.13.8
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• 3.3.1
• audit_rules_immutableMake the auditd Configuration Immutable
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• service_auditd_enabledEnable auditd Service
• 3.3.2
• service_auditd_enabledEnable auditd Service
• 3.3.6
• service_auditd_enabledEnable auditd Service
• 3.3.8
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• 3.4.1
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• 3.4.3
• audit_rules_immutableMake the auditd Configuration Immutable
• 3.4.5
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• require_singleuser_authRequire Authentication for Single User Mode
• 3.4.6
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• service_autofs_disabledDisable the Automounter
• 3.4.7
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• 3.4.8
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• 3.5.10
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• 3.5.4
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• 3.5.6
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• 3.5.7
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• 3.5.8
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• 3.7.2
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• disa
• CCI-000015
• account_use_centralized_automated_authUse Centralized and Automated Authentication
• CCI-000016
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• CCI-000017
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• CCI-000018
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-000022
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• CCI-000026
• selinux_stateEnsure SELinux State is Enforcing
• CCI-000032
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-000040
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• CCI-000044
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• CCI-000047
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• CCI-000048
• ftp_present_bannerCreate Warning Banners for All FTP Users
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-000050
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-000052
• sshd_print_last_logEnable SSH Print Last Log
• CCI-000054
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• CCI-000057
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• CCI-000058
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• package_screen_installedInstall the screen Package
• CCI-000060
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• CCI-000066
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• CCI-000067
• service_auditd_enabledEnable auditd Service
• sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
• CCI-000068
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• service_rexec_disabledDisable rexec Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• CCI-000085
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• service_bluetooth_disabledDisable Bluetooth Service
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• CCI-000087
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• CCI-000120
• service_auditd_enabledEnable auditd Service
• CCI-000126
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• CCI-000130
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• service_auditd_enabledEnable auditd Service
• CCI-000135
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• CCI-000136
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• CCI-000137
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• CCI-000138
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• CCI-000139
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• CCI-000140
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• CCI-000143
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• CCI-000144
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• CCI-000157
• service_auditd_enabledEnable auditd Service
• CCI-000158
• service_auditd_enabledEnable auditd Service
• CCI-000160
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• CCI-000164
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• CCI-000166
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• CCI-000169
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• CCI-000172
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
• audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
• audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
• audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
• audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
• audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
• audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
• audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
• audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• service_auditd_enabledEnable auditd Service
• CCI-000178
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• CCI-000180
• accounts_maximum_age_login_defsSet Password Maximum Age
• CCI-000192
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• CCI-000193
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• CCI-000194
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• CCI-000195
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• CCI-000196
• no_netrc_filesVerify No netrc Files Exist
• CCI-000197
• service_telnet_disabledDisable telnet Service
• CCI-000198
• accounts_minimum_age_login_defsSet Password Minimum Age
• CCI-000200
• accounts_password_pam_unix_rememberLimit Password Reuse
• CCI-000201
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• CCI-000205
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• CCI-000213
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• require_singleuser_authRequire Authentication for Single User Mode
• CCI-000224
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• CCI-000225
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• CCI-000305
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• CCI-000318
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• CCI-000347
• service_auditd_enabledEnable auditd Service
• CCI-000351
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• CCI-000352
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• CCI-000361
• accounts_tmoutSet Interactive Session Timeout
• CCI-000366
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• gconf_gdm_disable_user_listDisable the User List
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• install_antivirusInstall Virus Scanning Software
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• network_ipv6_default_gatewayManually Assign IPv6 Router Address
• network_ipv6_privacy_extensionsUse Privacy Extensions for Address
• network_ipv6_static_addressManually Assign Global IPv6 Address
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
• package_bind_removedUninstall bind Package
• package_dhcp_removedUninstall DHCP Server Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• partition_for_homeEnsure /home Located On Separate Partition
• postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_dhcpd_disabledDisable DHCP Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_named_disabledDisable named Service
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• CCI-000368
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• CCI-000374
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• CCI-000381
• mount_option_tmp_noexecAdd noexec Option to /tmp
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_atd_disabledDisable At Service (atd)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• CCI-000382
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_tipc_disabledDisable TIPC Support
• postfix_network_listening_disabledDisable Postfix Network Listening
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• CCI-000416
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• CCI-000535
• configure_user_data_backupsConfigure Backups of User Data
• CCI-000663
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• CCI-000764
• no_all_squash_exportsEnsure All-Squashing Disabled On All Exports
• no_insecure_locks_exportsEnsure Insecure File Locking is Not Allowed
• smartcard_authEnable Smart Card Login
• CCI-000765
• disable_host_authDisable Host-Based Authentication
• smartcard_authEnable Smart Card Login
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• CCI-000766
• disable_host_authDisable Host-Based Authentication
• smartcard_authEnable Smart Card Login
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• CCI-000767
• smartcard_authEnable Smart Card Login
• CCI-000768
• smartcard_authEnable Smart Card Login
• CCI-000770
• account_unique_nameEnsure All Accounts on the System Have Unique Names
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• smartcard_authEnable Smart Card Login
• sshd_disable_root_loginDisable SSH Root Login
• CCI-000771
• smartcard_authEnable Smart Card Login
• CCI-000772
• smartcard_authEnable Smart Card Login
• CCI-000774
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• CCI-000776
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• CCI-000778
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• service_autofs_disabledDisable the Automounter
• CCI-000803
• disable_prelinkDisable Prelinking
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• CCI-000804
• account_unique_nameEnsure All Accounts on the System Have Unique Names
• CCI-000831
• service_auditd_enabledEnable auditd Service
• CCI-000877
• service_telnet_disabledDisable telnet Service
• CCI-000879
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• CCI-000880
• service_auditd_enabledEnable auditd Service
• CCI-000884
• smartcard_authEnable Smart Card Login
• CCI-000888
• service_telnet_disabledDisable telnet Service
• CCI-001019
• encrypt_partitionsEncrypt Partitions
• CCI-001069
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• package_aide_installedInstall AIDE
• CCI-001092
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• CCI-001095
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• CCI-001097
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-001098
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-001100
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-001109
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• CCI-001115
• service_auditd_enabledEnable auditd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-001117
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-001118
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• CCI-001130
• package_libreswan_installedInstall libreswan Package
• CCI-001131
• package_libreswan_installedInstall libreswan Package
• CCI-001133
• accounts_tmoutSet Interactive Session Timeout
• CCI-001144
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• CCI-001145
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• CCI-001146
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• CCI-001154
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• CCI-001190
• service_auditd_enabledEnable auditd Service
• CCI-001200
• encrypt_partitionsEncrypt Partitions
• CCI-001208
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• CCI-001227
• security_patches_up_to_dateEnsure Software Patches Installed
• CCI-001233
• security_patches_up_to_dateEnsure Software Patches Installed
• CCI-001239
• install_antivirusInstall Virus Scanning Software
• CCI-001250
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• CCI-001263
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• install_hidsInstall Intrusion Detection Software
• service_auditd_enabledEnable auditd Service
• CCI-001297
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• CCI-001311
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• CCI-001312
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• service_auditd_enabledEnable auditd Service
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• CCI-001314
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• CCI-001343
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• CCI-001348
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• CCI-001353
• service_auditd_enabledEnable auditd Service
• CCI-001384
• banner_etc_issueModify the System Login Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-001385
• banner_etc_issueModify the System Login Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-001386
• banner_etc_issueModify the System Login Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-001387
• banner_etc_issueModify the System Login Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-001388
• banner_etc_issueModify the System Login Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• sshd_enable_warning_bannerEnable SSH Warning Banner
• CCI-001403
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001404
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001405
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001414
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• CCI-001436
• no_rsh_trust_filesRemove Rsh Trust Files
• package_vsftpd_removedUninstall vsftpd Package
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_smb_disabledDisable Samba
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• CCI-001452
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• CCI-001453
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• CCI-001454
• service_auditd_enabledEnable auditd Service
• CCI-001462
• service_auditd_enabledEnable auditd Service
• CCI-001487
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• service_auditd_enabledEnable auditd Service
• CCI-001493
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• CCI-001494
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• CCI-001495
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• CCI-001496
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• CCI-001499
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• CCI-001503
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• CCI-001551
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• service_bluetooth_disabledDisable Bluetooth Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• CCI-001557
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• CCI-001576
• auditd_data_retention_flushConfigure auditd flush priority
• CCI-001589
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• service_auditd_enabledEnable auditd Service
• CCI-001619
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• CCI-001668
• install_antivirusInstall Virus Scanning Software
• CCI-001682
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• CCI-001683
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001684
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001685
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001686
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-001764
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• CCI-001812
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• CCI-001813
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• CCI-001814
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• CCI-001851
• auditd_name_formatSet hostname as computer node name in audit logs
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• CCI-001855
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• CCI-001954
• service_pcscd_enabledEnable the pcscd Service
• CCI-001958
• service_autofs_disabledDisable the Automounter
• CCI-002007
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• CCI-002038
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• CCI-002130
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-002132
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• CCI-002418
• package_openssh-server_installedInstall the OpenSSH Server Package
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• CCI-002420
• package_openssh-server_installedInstall the OpenSSH Server Package
• CCI-002421
• package_openssh-server_installedInstall the OpenSSH Server Package
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• CCI-002422
• package_openssh-server_installedInstall the OpenSSH Server Package
• CCI-002449
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• CCI-002450
• disable_prelinkDisable Prelinking
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• CCI-002530
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• CCI-002824
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• CCI-002884
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• hipaa
• 164.308(a)(1)(ii)(B)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.308(a)(1)(ii)(D)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_retention_flushConfigure auditd flush priority
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.308(a)(3)
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.308(a)(3)(i)
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• service_autofs_disabledDisable the Automounter
• 164.308(a)(3)(ii)(A)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• service_autofs_disabledDisable the Automounter
• 164.308(a)(4)
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.308(a)(4)(i)
• disable_host_authDisable Host-Based Authentication
• no_rsh_trust_filesRemove Rsh Trust Files
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_talk-server_removedUninstall talk-server Package
• package_talk_removedUninstall talk Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_xinetd_removedUninstall xinetd Package
• package_ypbind_removedRemove NIS Client
• package_ypserv_removedUninstall ypserv Package
• service_crond_enabledEnable cron Service
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_priv_separationEnable Use of Privilege Separation
• 164.308(a)(5)(ii)(B)
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• 164.308(a)(5)(ii)(C)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_retention_flushConfigure auditd flush priority
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_auditd_enabledEnable auditd Service
• 164.308(a)(6)(ii)
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• 164.308(a)(7)(i)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.308(a)(7)(ii)(A)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.308(a)(8)
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• 164.308(b)(1)
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_talk-server_removedUninstall talk-server Package
• package_talk_removedUninstall talk Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_xinetd_removedUninstall xinetd Package
• package_ypbind_removedRemove NIS Client
• package_ypserv_removedUninstall ypserv Package
• service_crond_enabledEnable cron Service
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• 164.308(b)(2)
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• 164.308(b)(3)
• disable_host_authDisable Host-Based Authentication
• no_rsh_trust_filesRemove Rsh Trust Files
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_talk-server_removedUninstall talk-server Package
• package_talk_removedUninstall talk Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_xinetd_removedUninstall xinetd Package
• package_ypbind_removedRemove NIS Client
• package_ypserv_removedUninstall ypserv Package
• service_crond_enabledEnable cron Service
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_priv_separationEnable Use of Privilege Separation
• 164.310(a)(1)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.310(a)(2)(i)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.310(a)(2)(ii)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.310(a)(2)(iii)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• 164.310(a)(2)(iv)
• audit_rules_immutableMake the auditd Configuration Immutable
• service_auditd_enabledEnable auditd Service
• 164.310(b)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_rsh_trust_filesRemove Rsh Trust Files
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_talk-server_removedUninstall talk-server Package
• package_talk_removedUninstall talk Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_xinetd_removedUninstall xinetd Package
• package_ypbind_removedRemove NIS Client
• package_ypserv_removedUninstall ypserv Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_crond_enabledEnable cron Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.310(c)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.310(d)
• encrypt_partitionsEncrypt Partitions
• 164.310(d)(1)
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• service_autofs_disabledDisable the Automounter
• 164.310(d)(2)
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• service_autofs_disabledDisable the Automounter
• 164.310(d)(2)(iii)
• audit_rules_immutableMake the auditd Configuration Immutable
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• service_auditd_enabledEnable auditd Service
• 164.312(a)
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.312(a)(1)
• encrypt_partitionsEncrypt Partitions
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• service_autofs_disabledDisable the Automounter
• 164.312(a)(2)(i)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• 164.312(a)(2)(ii)
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• package_rsyslog_installedEnsure rsyslog is Installed
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• service_rsyslog_enabledEnable rsyslog Service
• 164.312(a)(2)(iii)
• encrypt_partitionsEncrypt Partitions
• 164.312(a)(2)(iv)
• encrypt_partitionsEncrypt Partitions
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• service_autofs_disabledDisable the Automounter
• 164.312(b)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_retention_flushConfigure auditd flush priority
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• 164.312(c)
• encrypt_partitionsEncrypt Partitions
• 164.312(c)(1)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• 164.312(c)(2)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• 164.312(d)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• encrypt_partitionsEncrypt Partitions
• 164.312(e)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• 164.312(e)(1)
• disable_host_authDisable Host-Based Authentication
• no_rsh_trust_filesRemove Rsh Trust Files
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_talk-server_removedUninstall talk-server Package
• package_talk_removedUninstall talk Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_xinetd_removedUninstall xinetd Package
• package_ypbind_removedRemove NIS Client
• package_ypserv_removedUninstall ypserv Package
• service_crond_enabledEnable cron Service
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• 164.312(e)(2)(i)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• 164.312(e)(2)(ii)
• disable_host_authDisable Host-Based Authentication
• no_rsh_trust_filesRemove Rsh Trust Files
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_talk-server_removedUninstall talk-server Package
• package_talk_removedUninstall talk Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_xinetd_removedUninstall xinetd Package
• package_ypbind_removedRemove NIS Client
• package_ypserv_removedUninstall ypserv Package
• service_crond_enabledEnable cron Service
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• 164.314(a)(2)(i)(C)
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• 164.314(a)(2)(iii)
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• 164.314(b)(2)(i)
• encrypt_partitionsEncrypt Partitions
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• isa-62443-2009
• 4.2.3
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• 4.2.3.10
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• 4.2.3.12
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• 4.2.3.4
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 4.2.3.7
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• 4.2.3.9
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• 4.3.2.6.7
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• 4.3.3.2.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• disable_host_authDisable Host-Based Authentication
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_nfs_disabledDisable Network File System (nfs)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.3.7
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• 4.3.3.3.9
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 4.3.3.4
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• install_hidsInstall Intrusion Detection Software
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 4.3.3.5.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.3
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.4
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.5
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.6
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.7
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.5.8
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_ntp_installedInstall the ntp service
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_sendmail_removedUninstall Sendmail Package
• package_syslogng_installedEnsure syslog-ng is Installed
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_network_listening_disabledDisable Postfix Network Listening
• postfix_server_bannerConfigure SMTP Greeting Banner
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.5
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.6
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.7
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.8
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.6.9
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.7.1
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.7.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.7.3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.3.7.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• 4.3.4.3.2
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• 4.3.4.3.3
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_defaultRoot Path Must Be Vendor Default
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• 4.3.4.3.8
• install_antivirusInstall Virus Scanning Software
• 4.3.4.4.4
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• 4.3.4.4.7
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 4.3.4.5.5
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• 4.3.4.5.6
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• 4.3.4.5.7
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• 4.3.4.5.8
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• 4.3.4.5.9
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• 4.4.2.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 4.4.2.2
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 4.4.2.4
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• 4.4.3.2
• install_antivirusInstall Virus Scanning Software
• 4.4.3.3
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• 4.4.3.4
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• isa-62443-2013
• SR 1.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.10
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.11
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.12
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.13
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.5
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.6
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.7
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.8
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 1.9
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.10
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• SR 2.11
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• SR 2.12
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• SR 2.2
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.3
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.4
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.5
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.6
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.7
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SR 2.8
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• SR 2.9
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• SR 3.1
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rpm_verify_hashesVerify File Hashes with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 3.2
• install_antivirusInstall Virus Scanning Software
• SR 3.3
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• SR 3.4
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• SR 3.5
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 3.8
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rpm_verify_hashesVerify File Hashes with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 3.9
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• SR 4.1
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 4.2
• package_openssh-server_installedInstall the OpenSSH Server Package
• SR 4.3
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 5.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 5.2
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 5.3
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 6.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• SR 6.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• disable_users_coredumpsDisable Core Dumps for All Users
• install_hidsInstall Intrusion Detection Software
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• postfix_server_bannerConfigure SMTP Greeting Banner
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• SR 7.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• disable_users_coredumpsDisable Core Dumps for All Users
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_syslogng_enabledEnable syslog-ng Service
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 7.2
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• disable_users_coredumpsDisable Core Dumps for All Users
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• SR 7.6
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SR 7.8
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• iso27001-2013
• A.10.1.1
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.11.1.2
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• A.11.1.4
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.11.1.5
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.11.2.1
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.11.2.4
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• package_aide_installedInstall AIDE
• package_libreswan_installedInstall libreswan Package
• rpm_verify_hashesVerify File Hashes with RPM
• A.11.2.5
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• A.11.2.6
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.11.2.9
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• A.12.1.1
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• A.12.1.2
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.12.1.3
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• disable_users_coredumpsDisable Core Dumps for All Users
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• A.12.1.4
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• A.12.2.1
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• A.12.4.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• A.12.4.2
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• A.12.4.3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• A.12.4.4
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• A.12.5.1
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.12.6.1
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• A.12.6.2
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.12.7.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• A.13.1.1
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.13.1.2
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• A.13.1.3
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.13.2.1
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.13.2.2
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• A.13.2.3
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh_removedUninstall rsh Package
• package_telnet_removedRemove telnet Clients
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.13.2.4
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.14.1.1
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• A.14.1.2
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_aide_installedInstall AIDE
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh_removedUninstall rsh Package
• package_telnet_removedRemove telnet Clients
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.14.1.3
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsh_removedUninstall rsh Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnet_removedRemove telnet Clients
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.14.2.1
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• A.14.2.2
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.14.2.3
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• security_patches_up_to_dateEnsure Software Patches Installed
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.14.2.4
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.14.2.5
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• A.14.2.7
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• A.14.2.8
• install_antivirusInstall Virus Scanning Software
• A.15.1.1
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• package_libreswan_installedInstall libreswan Package
• A.15.2.1
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_aide_installedInstall AIDE
• package_libreswan_installedInstall libreswan Package
• package_psacct_installedInstall the psacct package
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• A.15.2.2
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• A.16.1.1
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• A.16.1.2
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• A.16.1.3
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• A.16.1.4
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• A.16.1.5
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• A.16.1.6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• A.16.1.7
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• A.17.2.1
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• disable_users_coredumpsDisable Core Dumps for All Users
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• A.18.1.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.18.2.2
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• A.18.2.3
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• A.6.1.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_openssh-server_installedInstall the OpenSSH Server Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.6.1.3
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• A.6.1.5
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• A.6.2.1
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.6.2.2
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• A.7.1.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.7.1.2
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.7.3.1
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.8.1.1
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• A.8.1.2
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• A.8.2.1
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• A.8.2.2
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.8.2.3
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_aide_installedInstall AIDE
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_rsh_removedUninstall rsh Package
• package_telnet_removedRemove telnet Clients
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.8.3.1
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• A.8.3.3
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• A.9.1.1
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• A.9.1.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.9.2.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• banner_etc_issueModify the System Login Banner
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• disable_host_authDisable Host-Based Authentication
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_nfs_disabledDisable Network File System (nfs)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.9.2.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.9.2.3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• install_hidsInstall Intrusion Detection Software
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.9.2.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.9.2.6
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.9.3.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.9.4.1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_openssh-server_installedInstall the OpenSSH Server Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.9.4.2
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.9.4.3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• A.9.4.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_openssh-server_installedInstall the OpenSSH Server Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• A.9.4.5
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• encrypt_partitionsEncrypt Partitions
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_openssh-server_installedInstall the OpenSSH Server Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_nfs_disabledDisable Network File System (nfs)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• nist
• sshd_disable_root_loginDisable SSH Root Login
• AC-10
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• AC-11(a)
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• AC-11(b)
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• AC-12
• accounts_tmoutSet Interactive Session Timeout
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• AC-17(1)
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
• AC-17(2)
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• AC-17(a)
• disable_host_authDisable Host-Based Authentication
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_set_loglevel_infoSet LogLevel to INFO
• sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• AC-18(3)
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• service_bluetooth_disabledDisable Bluetooth Service
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• AC-18(a)
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• service_bluetooth_disabledDisable Bluetooth Service
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• AC-2(2)
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• AC-2(3)
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• AC-2(4)
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• AC-2(5)
• accounts_tmoutSet Interactive Session Timeout
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• AC-2(g)
• service_auditd_enabledEnable auditd Service
• AC-23
• gconf_gdm_disable_user_listDisable the User List
• AC-3
• disable_host_authDisable Host-Based Authentication
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• require_singleuser_authRequire Authentication for Single User Mode
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• sshd_limit_user_accessLimit Users' SSH Access
• AC-3(10)
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• AC-3(3)(a)
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• AC-4
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• AC-6
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_priv_separationEnable Use of Privilege Separation
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• AC-6(1)
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
• sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
• umask_for_daemonsSet Daemon Umask
• AC-6(2)
• sshd_disable_root_loginDisable SSH Root Login
• AC-6(5)
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• AC-6(9)
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• directory_access_var_log_auditRecord Access Events to Audit Log Directory
• service_auditd_enabledEnable auditd Service
• AC-7(a)
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• package_audit_installedEnsure the audit Subsystem is Installed
• AC-7(b)
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• AC-8(a)
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• postfix_server_bannerConfigure SMTP Greeting Banner
• sshd_enable_warning_bannerEnable SSH Warning Banner
• AC-8(b)
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• AC-8(c)
• banner_etc_issueModify the System Login Banner
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• postfix_server_bannerConfigure SMTP Greeting Banner
• sshd_enable_warning_bannerEnable SSH Warning Banner
• AC-9
• sshd_print_last_logEnable SSH Print Last Log
• AC-9(1)
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• AU-10
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• AU-11
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• AU-12(2)
• package_audit_installedEnsure the audit Subsystem is Installed
• AU-12(a)
• dhcp_server_configure_loggingConfigure Logging
• package_psacct_installedInstall the psacct package
• service_psacct_enabledEnable Process Accounting (psacct)
• AU-12(c)
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
• audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
• audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
• audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
• audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
• audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
• audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
• audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
• audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dhcp_server_configure_loggingConfigure Logging
• directory_access_var_log_auditRecord Access Events to Audit Log Directory
• service_auditd_enabledEnable auditd Service
• AU-14
• package_audit_installedEnsure the audit Subsystem is Installed
• AU-14(1)
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• AU-2(a)
• package_audit_installedEnsure the audit Subsystem is Installed
• AU-2(d)
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
• audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
• audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
• audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
• audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
• audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
• audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
• audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
• audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• directory_access_var_log_auditRecord Access Events to Audit Log Directory
• service_auditd_enabledEnable auditd Service
• AU-3
• service_auditd_enabledEnable auditd Service
• AU-4
• partition_for_var_logEnsure /var/log Located On Separate Partition
• AU-4(1)
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• AU-5(1)
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• AU-5(2)
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• AU-5(4)
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• AU-5(a)
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• AU-5(b)
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• AU-6(3)
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• AU-6(4)
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• AU-7(1)
• package_audit_installedEnsure the audit Subsystem is Installed
• AU-7(2)
• package_audit_installedEnsure the audit Subsystem is Installed
• AU-8(1)(a)
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• AU-8(2)
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• AU-9
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• AU-9(2)
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• AU-9(3)
• rpm_verify_hashesVerify File Hashes with RPM
• AU-9(4)
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• CA-3(5)
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• CM-11(a)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• CM-11(b)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• CM-5(3)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• CM-6(a)
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_tmoutSet Interactive Session Timeout
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
• audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
• audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
• audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
• audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
• audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
• audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
• audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
• audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_configure_loggingConfigure Logging
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_access_var_log_auditRecord Access Events to Audit Log Directory
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_anacronDisable anacron Service
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_disable_user_listDisable the User List
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• install_antivirusInstall Virus Scanning Software
• install_hidsInstall Intrusion Detection Software
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
• no_rsh_trust_filesRemove Rsh Trust Files
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_aide_installedInstall AIDE
• package_audit_installedEnsure the audit Subsystem is Installed
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_iptables_installedInstall iptables Package
• package_libreswan_installedInstall libreswan Package
• package_ntp_installedInstall the ntp service
• package_openldap-servers_removedUninstall openldap-servers Package
• package_openssh-server_installedInstall the OpenSSH Server Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_screen_installedInstall the screen Package
• package_sendmail_removedUninstall Sendmail Package
• package_sssd_installedInstall the SSSD Package
• package_sudo_installedInstall sudo Package
• package_syslogng_installedEnsure syslog-ng is Installed
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_var_logEnsure /var/log Located On Separate Partition
• postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• root_path_defaultRoot Path Must Be Vendor Default
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• security_patches_up_to_dateEnsure Software Patches Installed
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_pcscd_enabledEnable the pcscd Service
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_rsyslog_enabledEnable rsyslog Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sssd_enabledEnable the SSSD Service
• service_syslogng_enabledEnable syslog-ng Service
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_set_loglevel_infoSet LogLevel to INFO
• sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
• sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• umask_for_daemonsSet Daemon Umask
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• CM-6(b)
• network_ipv6_default_gatewayManually Assign IPv6 Router Address
• network_ipv6_privacy_extensionsUse Privacy Extensions for Address
• network_ipv6_static_addressManually Assign Global IPv6 Address
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• CM-6(c)
• rpm_verify_hashesVerify File Hashes with RPM
• CM-6(d)
• rpm_verify_hashesVerify File Hashes with RPM
• CM-7(2)
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• CM-7(a)
• avahi_disable_publishingDisable Avahi Publishing
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• CM-7(b)
• avahi_disable_publishingDisable Avahi Publishing
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gdm_disable_user_listDisable the User List
• gconf_gnome_disable_automountDisable GNOME Automounting
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• CM6(a)
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• IA-11
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• IA-2
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• no_direct_root_loginsDirect root Logins Not Allowed
• require_singleuser_authRequire Authentication for Single User Mode
• sshd_disable_root_loginDisable SSH Root Login
• IA-2(1)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-2(11)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-2(2)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-2(3)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-2(4)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-2(5)
• sshd_disable_root_loginDisable SSH Root Login
• IA-2(6)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-2(7)
• service_pcscd_enabledEnable the pcscd Service
• smartcard_authEnable Smart Card Login
• IA-4(b)
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• IA-4(e)
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• IA-5(1)
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• IA-5(1)(a)
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• IA-5(1)(b)
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• IA-5(1)(c)
• no_netrc_filesVerify No netrc Files Exist
• package_rsh-server_removedUninstall rsh-server Package
• package_ypserv_removedUninstall ypserv Package
• service_rexec_disabledDisable rexec Service
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_telnet_disabledDisable telnet Service
• service_ypbind_disabledDisable ypbind Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• IA-5(1)(d)
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_password_warn_age_login_defsSet Password Warning Age
• IA-5(1)(e)
• accounts_password_pam_unix_rememberLimit Password Reuse
• IA-5(10)
• service_sssd_enabledEnable the SSSD Service
• IA-5(13)
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• IA-5(4)
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• IA-5(7)
• no_netrc_filesVerify No netrc Files Exist
• IA-5(c)
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• IA-5(e)
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• IA-5(f)
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• IA-5(h)
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• no_netrc_filesVerify No netrc Files Exist
• IA-7
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• IR-5(1)
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• MA-3
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• MA-4(6)
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• MA-6
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• MP-2
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• MP-7
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SA-12
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• SA-12(10)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• SA-13(a)
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• SC-10
• accounts_tmoutSet Interactive Session Timeout
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• SC-12
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• SC-12(2)
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SC-12(3)
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SC-12(a)
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• SC-12(b)
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• SC-13
• disable_prelinkDisable Prelinking
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SC-2(1)
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• SC-28
• encrypt_partitionsEncrypt Partitions
• SC-30
• sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• SC-30(2)
• sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• SC-30(5)
• sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
• SC-32
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• SC-39
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• SC-5
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• SC-5(1)
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• SC-5(2)
• partition_for_var_logEnsure /var/log Located On Separate Partition
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• SC-5(3)(a)
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• SC-5CM-6(a)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• SC-7(21)
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• SC-7(23)
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• SC-7(a)
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• SI-11(a)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• SI-11(b)
• sysctl_fs_suid_dumpableDisable Core Dumps for SUID programs
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• SI-2(5)
• security_patches_up_to_dateEnsure Software Patches Installed
• SI-2(c)
• security_patches_up_to_dateEnsure Software Patches Installed
• SI-7
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• SI-7(1)
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• SI-7(6)
• rpm_verify_hashesVerify File Hashes with RPM
• nist-csf
• DE.AE-1
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• DE.AE-3
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• DE.AE-5
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• DE.CM-1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• disable_users_coredumpsDisable Core Dumps for All Users
• install_hidsInstall Intrusion Detection Software
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• DE.CM-3
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_psacct_installedInstall the psacct package
• postfix_server_bannerConfigure SMTP Greeting Banner
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• DE.CM-4
• install_antivirusInstall Virus Scanning Software
• DE.CM-7
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• package_aide_installedInstall AIDE
• package_psacct_installedInstall the psacct package
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• DE.DP-3
• install_antivirusInstall Virus Scanning Software
• DE.DP-5
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• ID.AM-1
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• ID.AM-3
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• ID.RA-1
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• ID.SC-4
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_data_retention_flushConfigure auditd flush priority
• dhcp_server_configure_loggingConfigure Logging
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• package_psacct_installedInstall the psacct package
• service_auditd_enabledEnable auditd Service
• service_psacct_enabledEnable Process Accounting (psacct)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• PR.AC-1
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• PR.AC-3
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• gconf_gnome_disable_automountDisable GNOME Automounting
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_autofs_disabledDisable the Automounter
• service_bluetooth_disabledDisable Bluetooth Service
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• PR.AC-4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• disable_host_authDisable Host-Based Authentication
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_nfs_disabledDisable Network File System (nfs)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• PR.AC-5
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• install_hidsInstall Intrusion Detection Software
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• PR.AC-6
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• bios_disable_usb_bootDisable Booting from USB Devices in Boot Firmware
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• disable_host_authDisable Host-Based Authentication
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_automountDisable GNOME Automounting
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• grub_legacy_nousb_argumentDisable Kernel Support for USB via Bootloader Configuration
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_shelllogin_for_systemaccountsEnsure that System Accounts Do Not Run a Shell Upon Login
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_nfs_disabledDisable Network File System (nfs)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• PR.AC-7
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• accounts_maximum_age_login_defsSet Password Maximum Age
• accounts_minimum_age_login_defsSet Password Minimum Age
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_password_pam_unix_rememberLimit Password Reuse
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• accounts_tmoutSet Interactive Session Timeout
• banner_etc_issueModify the System Login Banner
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• cracklib_accounts_password_pam_retrySet Password Retry Prompts Permitted Per-Session
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• no_direct_root_loginsDirect root Logins Not Allowed
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_netrc_filesVerify No netrc Files Exist
• package_screen_installedInstall the screen Package
• package_sssd_installedInstall the SSSD Package
• require_singleuser_authRequire Authentication for Single User Mode
• service_autofs_disabledDisable the Automounter
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_sssd_enabledEnable the SSSD Service
• service_telnet_disabledDisable telnet Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• smartcard_authEnable Smart Card Login
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_warning_bannerEnable SSH Warning Banner
• sshd_print_last_logEnable SSH Print Last Log
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• PR.DS-1
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• encrypt_partitionsEncrypt Partitions
• install_antivirusInstall Virus Scanning Software
• package_aide_installedInstall AIDE
• PR.DS-2
• package_openssh-server_installedInstall the OpenSSH Server Package
• PR.DS-4
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• disable_users_coredumpsDisable Core Dumps for All Users
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• PR.DS-5
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• audit_rules_immutableMake the auditd Configuration Immutable
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_home_dirsEnsure that User Home Directories are not Group-Writable or World-Readable
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_unauthorized_sgidEnsure All SGID Executables Are Authorized
• file_permissions_unauthorized_suidEnsure All SUID Executables Are Authorized
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• gconf_gnome_disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Key Sequence in GNOME
• gconf_gnome_disable_restart_shutdownDisable the GNOME Login Restart and Shutdown Buttons
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• install_hidsInstall Intrusion Detection Software
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_openssh-server_installedInstall the OpenSSH Server Package
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_root_loginDisable SSH Root Login
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• PR.DS-6
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• PR.DS-7
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• PR.DS-8
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• PR.IP-1
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• accounts_root_path_dirs_no_writeEnsure that Root's Path Does Not Include World or Group-Writable Directories
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• bios_enable_execution_restrictionsEnable NX or XD Support in the BIOS
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• disable_prelinkDisable Prelinking
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• install_PAE_kernel_on_x86-32Install PAE Kernel on Supported 32-bit x86 Systems
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_rsh_trust_filesRemove Rsh Trust Files
• package_aide_installedInstall AIDE
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• root_path_no_dotEnsure that Root's Path Does Not Include Relative Paths or Null Directories
• rpm_verify_hashesVerify File Hashes with RPM
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• PR.IP-12
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• security_patches_up_to_dateEnsure Software Patches Installed
• PR.IP-2
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• root_path_defaultRoot Path Must Be Vendor Default
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• PR.IP-3
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• package_aide_installedInstall AIDE
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• PR.IP-8
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• PR.MA-1
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• PR.MA-2
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• package_libreswan_installedInstall libreswan Package
• PR.PT-1
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• dhcp_server_configure_loggingConfigure Logging
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• package_ntp_installedInstall the ntp service
• package_psacct_installedInstall the psacct package
• package_rsyslog_installedEnsure rsyslog is Installed
• package_syslogng_installedEnsure syslog-ng is Installed
• partition_for_var_logEnsure /var/log Located On Separate Partition
• postfix_server_bannerConfigure SMTP Greeting Banner
• rsyslog_accept_remote_messages_tcpEnable rsyslog to Accept Messages via TCP, if Acting As Log Server
• rsyslog_accept_remote_messages_udpEnable rsyslog to Accept Messages via UDP, if Acting As Log Server
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_auditd_enabledEnable auditd Service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• service_psacct_enabledEnable Process Accounting (psacct)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rsyslog_enabledEnable rsyslog Service
• service_syslogng_enabledEnable syslog-ng Service
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• PR.PT-2
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• PR.PT-3
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• avahi_check_ttlCheck Avahi Responses' TTL Field
• avahi_disable_publishingDisable Avahi Publishing
• avahi_ip_onlyServe Avahi Only via Required Protocol
• avahi_prevent_port_sharingPrevent Other Programs from Using Avahi's Port
• avahi_restrict_published_informationRestrict Information Published by Avahi
• cups_disable_browsingDisable Printer Browsing Entirely if Possible
• cups_disable_printserverDisable Print Server Capabilities
• dhcp_server_deny_bootpDeny BOOTP Queries
• dhcp_server_deny_declineDeny Decline Messages
• dhcp_server_disable_ddnsDo Not Use Dynamic DNS
• dhcp_server_minimize_served_infoMinimize Served Information
• dir_perms_var_log_httpdSet Permissions on the /var/log/httpd/ Directory
• disable_anacronDisable anacron Service
• disable_host_authDisable Host-Based Authentication
• dns_server_authenticate_zone_transfersAuthenticate Zone Transfers
• file_permissions_httpd_server_conf_filesSet Permissions on All Configuration Files Inside /etc/httpd/conf/
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• ftp_restrict_to_anonRestrict Access to Anonymous Users if Possible
• gconf_gnome_disable_thumbnailersDisable All GNOME Thumbnailers
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• httpd_serversignature_offSet httpd ServerSignature Directive to Off
• httpd_servertokens_prodSet httpd ServerTokens Directive to Prod
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_freevxfs_disabledDisable Mounting of freevxfs
• kernel_module_hfs_disabledDisable Mounting of hfs
• kernel_module_hfsplus_disabledDisable Mounting of hfsplus
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• kernel_module_jffs2_disabledDisable Mounting of jffs2
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_squashfs_disabledDisable Mounting of squashfs
• kernel_module_tipc_disabledDisable TIPC Support
• kernel_module_udf_disabledDisable Mounting of udf
• kernel_module_vfat_disabledDisable Mounting of vFAT filesystems
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nodev_removable_partitionsAdd nodev Option to Removable Media Partitions
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_noexecAdd noexec Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_bindBind Mount /var/tmp To /tmp
• network_disable_zeroconfDisable Zeroconf Networking
• network_ipv6_disable_rpcDisable Support for RPC IPv6
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• no_netrc_filesVerify No netrc Files Exist
• no_rsh_trust_filesRemove Rsh Trust Files
• package_bind_removedUninstall bind Package
• package_cron_installedInstall the cron service
• package_dhcp_removedUninstall DHCP Server Package
• package_httpd_removedUninstall httpd Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_openldap-servers_removedUninstall openldap-servers Package
• package_psacct_installedInstall the psacct package
• package_rsh-server_removedUninstall rsh-server Package
• package_sendmail_removedUninstall Sendmail Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_vsftpd_installedInstall vsftpd Package
• package_vsftpd_removedUninstall vsftpd Package
• package_xinetd_removedUninstall xinetd Package
• package_ypserv_removedUninstall ypserv Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• require_singleuser_authRequire Authentication for Single User Mode
• restrict_nfs_clients_to_privileged_portsRestrict NFS Clients to Privileged Ports
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_confinement_of_daemonsEnsure No Daemons are Unconfined by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_acpid_disabledDisable Advanced Configuration and Power Interface (acpid)
• service_atd_disabledDisable At Service (atd)
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_bluetooth_disabledDisable Bluetooth Service
• service_certmonger_disabledDisable Certmonger Service (certmonger)
• service_cgconfig_disabledDisable Control Group Config (cgconfig)
• service_cgred_disabledDisable Control Group Rules Engine (cgred)
• service_cpuspeed_disabledDisable CPU Speed (cpuspeed)
• service_cron_enabledEnable cron Service
• service_crond_enabledEnable cron Service
• service_cups_disabledDisable the CUPS Service
• service_dhcpd_disabledDisable DHCP Service
• service_haldaemon_disabledDisable Hardware Abstraction Layer Service (haldaemon)
• service_httpd_disabledDisable httpd Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_irqbalance_enabledEnable IRQ Balance (irqbalance)
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_mdmonitor_disabledDisable Software RAID Monitor (mdmonitor)
• service_messagebus_disabledDisable D-Bus IPC Service (messagebus)
• service_named_disabledDisable named Service
• service_netconsole_disabledDisable Network Console (netconsole)
• service_nfs_disabledDisable Network File System (nfs)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_psacct_enabledEnable Process Accounting (psacct)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_quota_nld_disabledDisable Quota Netlink (quota_nld)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rhsmcertd_disabledDisable Red Hat Subscription Manager Daemon (rhsmcertd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_smartd_disabledDisable SMART Disk Monitoring Service (smartd)
• service_sysstat_disabledDisable System Statistics Reset Service (sysstat)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_vsftpd_disabledDisable vsftpd Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_root_loginDisable SSH Root Login
• sshd_limit_user_accessLimit Users' SSH Access
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_forwardingDisable Kernel Parameter for IPv6 Forwarding
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• PR.PT-4
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• grub_legacy_enable_fips_modeEnable FIPS Mode in GRUB Legacy
• install_hidsInstall Intrusion Detection Software
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• no_rsh_trust_filesRemove Rsh Trust Files
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• package_inetutils-telnetd_removedUninstall the inet-based telnet server
• package_libreswan_installedInstall libreswan Package
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_telnetd-ssl_removedUninstall the ssl compliant telnet server
• package_telnetd_removedUninstall the telnet server
• package_tftp-server_removedUninstall tftp-server Package
• package_xinetd_removedUninstall xinetd Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• package_ypserv_removedUninstall ypserv Package
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_auditd_enabledEnable auditd Service
• service_bluetooth_disabledDisable Bluetooth Service
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_portreserve_disabledDisable Portreserve (portreserve)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_restorecond_enabledEnable the SELinux Context Restoration Service (restorecond)
• service_rexec_disabledDisable rexec Service
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_rlogin_disabledDisable rlogin Service
• service_rsh_disabledDisable rsh Service
• service_saslauthd_disabledDisable Cyrus SASL Authentication Daemon (saslauthd)
• service_telnet_disabledDisable telnet Service
• service_tftp_disabledDisable tftp Service
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• wireless_disable_in_biosDisable WiFi or Bluetooth in BIOS
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• RS.AN-1
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• RS.AN-4
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_immutableMake the auditd Configuration Immutable
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• service_auditd_enabledEnable auditd Service
• ospp
• FAU_GEN.1
• auditd_freqSet number of records to cause an explicit flush to audit logs
• auditd_log_formatResolve information before writing to audit logs
• auditd_name_formatSet hostname as computer node name in audit logs
• FAU_GEN.1.1.c
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• auditd_local_eventsInclude Local Events in Audit Logs
• auditd_write_logsWrite Audit Logs to the Disk
• directory_access_var_log_auditRecord Access Events to Audit Log Directory
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• FCS_SSHC_EXT.1
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• FCS_SSHS_EXT.1
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• sshd_rekey_limitForce frequent session key renegotiation
• FIA_AFL.1
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• FIA_UAU.1
• disable_host_authDisable Host-Based Authentication
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• require_singleuser_authRequire Authentication for Single User Mode
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• FIA_UAU.5
• package_openssh-server_installedInstall the OpenSSH Server Package
• FMT_MOF_EXT.1
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• accounts_tmoutSet Interactive Session Timeout
• banner_etc_issueModify the System Login Banner
• package_screen_installedInstall the screen Package
• security_patches_up_to_dateEnsure Software Patches Installed
• FMT_SMF_EXT.1
• coredump_disable_backtracesDisable core dump backtraces
• coredump_disable_storageDisable storing core dump
• kernel_module_atm_disabledDisable ATM Support
• kernel_module_can_disabledDisable CAN Support
• kernel_module_tipc_disabledDisable TIPC Support
• package_gnutls-utils_installedEnsure gnutls-utils is installed
• package_nss-tools_installedEnsure nss-tools is installed
• package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
• FPT_TUD_EXT.1
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• package_subscription-manager_installedInstall subscription-manager Package
• FPT_TUD_EXT.2
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• package_subscription-manager_installedInstall subscription-manager Package
• FTA_TAB.1
• sshd_enable_warning_bannerEnable SSH Warning Banner
• FTP_ITC_EXT.1
• kerberos_disable_no_keytabDisable Kerberos by removing host keytab
• package_openssh-server_installedInstall the OpenSSH Server Package
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• pcidss
• Req-10.1
• service_auditd_enabledEnable auditd Service
• Req-10.2.1
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• Req-10.2.2
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• Req-10.2.3
• audit_rules_login_eventsRecord Attempts to Alter Logon and Logout Events
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_session_eventsRecord Attempts to Alter Process and Session Initiation Information
• Req-10.2.4
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• Req-10.2.5
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• Req-10.2.5.b
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• Req-10.2.7
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• Req-10.3
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• Req-10.4
• package_ntp_installedInstall the ntp service
• service_ntp_enabledEnable the NTP Daemon
• service_ntpd_enabledEnable the NTP Daemon
• Req-10.4.1
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• Req-10.4.2.b
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• Req-10.4.3
• ntpd_specify_multiple_serversSpecify Additional Remote NTP Servers
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• Req-10.5
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• Req-10.5.1
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• Req-10.5.2
• audit_rules_immutableMake the auditd Configuration Immutable
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• Req-10.5.3
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• Req-10.5.5
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• Req-10.7
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• Req-10.7.a
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• Req-11.4
• install_hidsInstall Intrusion Detection Software
• Req-11.5
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• disable_prelinkDisable Prelinking
• package_aide_installedInstall AIDE
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• Req-4.1
• package_libreswan_installedInstall libreswan Package
• Req-6.2
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• security_patches_up_to_dateEnsure Software Patches Installed
• Req-7.1
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• Req-8.1.1
• account_unique_nameEnsure All Accounts on the System Have Unique Names
• Req-8.1.4
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• Req-8.1.6
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• Req-8.1.7
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• Req-8.1.8
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• Req-8.2.1
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• Req-8.2.3
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• cracklib_accounts_password_pam_minlenSet Password Minimum Length
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• Req-8.2.4
• accounts_maximum_age_login_defsSet Password Maximum Age
• Req-8.2.5
• accounts_password_pam_unix_rememberLimit Password Reuse
• Req-8.3
• smartcard_authEnable Smart Card Login
• Req-8.5.a
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• Req-8.7.c
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• rg
• SRG-OS-999999
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• srg
• SRG-OS-000001
• account_use_centralized_automated_authUse Centralized and Automated Authentication
• SRG-OS-000004
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• SRG-OS-000004-GPOS-00004
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000020
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• SRG-OS-000021
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• SRG-OS-000022
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• SRG-OS-000023
• ftp_present_bannerCreate Warning Banners for All FTP Users
• sshd_enable_warning_bannerEnable SSH Warning Banner
• SRG-OS-000024
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• SRG-OS-000025
• sshd_print_last_logEnable SSH Print Last Log
• SRG-OS-000027
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• SRG-OS-000029
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• SRG-OS-000030
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• package_screen_installedInstall the screen Package
• SRG-OS-000031
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• SRG-OS-000032
• service_auditd_enabledEnable auditd Service
• SRG-OS-000032-GPOS-00013
• sshd_set_loglevel_verboseSet SSH Daemon LogLevel to VERBOSE
• SRG-OS-000033
• service_rexec_disabledDisable rexec Service
• service_rsh_disabledDisable rsh Service
• SRG-OS-000033-GPOS-00014
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• SRG-OS-000034
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• service_bluetooth_disabledDisable Bluetooth Service
• SRG-OS-000035
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• SRG-OS-000037
• ftp_log_transactionsEnable Logging of All FTP Transactions
• service_auditd_enabledEnable auditd Service
• SRG-OS-000037-GPOS-00015
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• SRG-OS-000039-GPOS-00017
• auditd_name_formatSet hostname as computer node name in audit logs
• SRG-OS-000042-GPOS-00020
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• SRG-OS-000043
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• SRG-OS-000044
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• SRG-OS-000045
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• SRG-OS-000046
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• SRG-OS-000047
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• SRG-OS-000048
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• SRG-OS-000051-GPOS-00024
• auditd_freqSet number of records to cause an explicit flush to audit logs
• package_rsyslog_installedEnsure rsyslog is Installed
• SRG-OS-000056
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• service_ntpd_enabledEnable the NTP Daemon
• SRG-OS-000057
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• SRG-OS-000058
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• SRG-OS-000059
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• SRG-OS-000062
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• SRG-OS-000062-GPOS-00031
• auditd_local_eventsInclude Local Events in Audit Logs
• SRG-OS-000064
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• SRG-OS-000064-GPOS-00033
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• SRG-OS-000069
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• SRG-OS-000070
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• SRG-OS-000071
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• SRG-OS-000072
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• SRG-OS-000073
• no_netrc_filesVerify No netrc Files Exist
• SRG-OS-000075
• accounts_minimum_age_login_defsSet Password Minimum Age
• SRG-OS-000076
• accounts_maximum_age_login_defsSet Password Maximum Age
• SRG-OS-000077
• accounts_password_pam_unix_rememberLimit Password Reuse
• SRG-OS-000078
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• SRG-OS-000080
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• require_singleuser_authRequire Authentication for Single User Mode
• SRG-OS-000090
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• SRG-OS-000094
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• SRG-OS-000095
• package_rsh-server_removedUninstall rsh-server Package
• package_telnet-server_removedUninstall telnet-server Package
• package_tftp-server_removedUninstall tftp-server Package
• package_ypserv_removedUninstall ypserv Package
• SRG-OS-000095-GPOS-00049
• kernel_module_atm_disabledDisable ATM Support
• kernel_module_can_disabledDisable CAN Support
• kernel_module_cramfs_disabledDisable Mounting of cramfs
• package_abrt-addon-ccpp_removedUninstall abrt-addon-ccpp Package
• package_abrt-addon-kerneloops_removedUninstall abrt-addon-kerneloops Package
• package_abrt-addon-python_removedUninstall abrt-addon-python Package
• package_abrt-cli_removedUninstall abrt-cli Package
• package_abrt-plugin-logger_removedUninstall abrt-plugin-logger Package
• package_abrt-plugin-rhtsupport_removedUninstall abrt-plugin-rhtsupport Package
• package_abrt-plugin-sosreport_removedUninstall abrt-plugin-sosreport Package
• package_abrt_removedUninstall Automatic Bug Reporting Tool (abrt)
• package_gssproxy_removedUninstall gssproxy Package
• package_iprutils_removedUninstall iprutils Package
• package_krb5-workstation_removedUninstall krb5-workstation Package
• package_nfs-utils_removedUninstall nfs-utils Package
• package_tuned_removedUninstall tuned Package
• SRG-OS-000096
• kernel_module_dccp_disabledDisable DCCP Support
• kernel_module_rds_disabledDisable RDS Support
• kernel_module_sctp_disabledDisable SCTP Support
• kernel_module_tipc_disabledDisable TIPC Support
• package_xinetd_removedUninstall xinetd Package
• postfix_network_listening_disabledDisable Postfix Network Listening
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• service_atd_disabledDisable At Service (atd)
• service_netconsole_disabledDisable Network Console (netconsole)
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• service_xinetd_disabledDisable xinetd Service
• service_ypbind_disabledDisable ypbind Service
• SRG-OS-000098
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• SRG-OS-000099
• configure_user_data_backupsConfigure Backups of User Data
• SRG-OS-000103
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• SRG-OS-000104
• no_all_squash_exportsEnsure All-Squashing Disabled On All Exports
• no_insecure_locks_exportsEnsure Insecure File Locking is Not Allowed
• SRG-OS-000104-GPOS-00051
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• SRG-OS-000105
• smartcard_authEnable Smart Card Login
• SRG-OS-000106
• disable_host_authDisable Host-Based Authentication
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• SRG-OS-000109
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• sshd_disable_root_loginDisable SSH Root Login
• SRG-OS-000112
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• SRG-OS-000118
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• SRG-OS-000120
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• SRG-OS-000120-GPOS-00061
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• kerberos_disable_no_keytabDisable Kerberos by removing host keytab
• package_krb5-workstation_removedUninstall krb5-workstation Package
• package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
• SRG-OS-000121
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• account_unique_nameEnsure All Accounts on the System Have Unique Names
• SRG-OS-000122-GPOS-00063
• package_audit_installedEnsure the audit Subsystem is Installed
• SRG-OS-000123
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• SRG-OS-000125-GPOS-00065
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000126
• sshd_set_keepaliveSet SSH Client Alive Max Count
• SRG-OS-000129
• service_telnet_disabledDisable telnet Service
• SRG-OS-000131
• encrypt_partitionsEncrypt Partitions
• SRG-OS-000132-GPOS-00067
• sysctl_kernel_dmesg_restrictRestrict Access to Kernel Message Buffer
• sysctl_kernel_kptr_restrictRestrict Exposed Kernel Pointer Addresses Access
• sysctl_kernel_yama_ptrace_scopeRestrict usage of ptrace to descendant processes
• SRG-OS-000142
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• SRG-OS-000145
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• SRG-OS-000146
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• SRG-OS-000147
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• SRG-OS-000152
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• service_iptables_enabledVerify iptables Enabled
• SRG-OS-000160
• package_libreswan_installedInstall libreswan Package
• SRG-OS-000163
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• SRG-OS-000163-GPOS-00072
• accounts_tmoutSet Interactive Session Timeout
• SRG-OS-000169
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• SRG-OS-000185
• encrypt_partitionsEncrypt Partitions
• SRG-OS-000191
• security_patches_up_to_dateEnsure Software Patches Installed
• SRG-OS-000191-GPOS-00080
• package_openscap-scanner_installedInstall openscap-scanner Package
• SRG-OS-000196
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• install_hidsInstall Intrusion Detection Software
• SRG-OS-000202
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• SRG-OS-000206
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• SRG-OS-000215
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• SRG-OS-000228
• banner_etc_issueModify the System Login Banner
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• SRG-OS-000230
• encrypt_partitionsEncrypt Partitions
• SRG-OS-000231
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• SRG-OS-000232
• aide_build_databaseBuild and Test AIDE Database
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• package_aide_installedInstall AIDE
• SRG-OS-000239
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• SRG-OS-000239-GPOS-00089
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000240
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• SRG-OS-000240-GPOS-00090
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000241
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• SRG-OS-000241-GPOS-00091
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000242
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• SRG-OS-000248
• no_rsh_trust_filesRemove Rsh Trust Files
• service_rlogin_disabledDisable rlogin Service
• service_tftp_disabledDisable tftp Service
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• SRG-OS-000249
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• SRG-OS-000250-GPOS-00093
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• harden_sshd_crypto_policyHarden SSHD Crypto Policy
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000255
• service_auditd_enabledEnable auditd Service
• SRG-OS-000255-GPOS-00096
• auditd_log_formatResolve information before writing to audit logs
• SRG-OS-000256
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• SRG-OS-000257
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• SRG-OS-000258
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• SRG-OS-000259
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• SRG-OS-000265
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• SRG-OS-000266
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• SRG-OS-000273
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• SRG-OS-000274-GPOS-00104
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000275-GPOS-00105
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000276-GPOS-00106
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000277-GPOS-00107
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000278
• rpm_verify_hashesVerify File Hashes with RPM
• SRG-OS-000303-GPOS-00120
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000324-GPOS-00125
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• package_sudo_installedInstall sudo Package
• sysctl_fs_protected_hardlinksEnable Kernel Parameter to Enforce DAC on Hardlinks
• sysctl_fs_protected_symlinksEnable Kernel Parameter to Enforce DAC on Symlinks
• SRG-OS-000342-GPOS-00133
• auditd_name_formatSet hostname as computer node name in audit logs
• package_audispd-plugins_installedInstall audispd-plugins Package
• SRG-OS-000364-GPOS-00151
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• SRG-OS-000366-GPOS-00153
• package_subscription-manager_installedInstall subscription-manager Package
• SRG-OS-000368-GPOS-00154
• mount_option_boot_nodevAdd nodev Option to /boot
• mount_option_boot_nosuidAdd nosuid Option to /boot
• mount_option_dev_shm_nodevAdd nodev Option to /dev/shm
• mount_option_dev_shm_noexecAdd noexec Option to /dev/shm
• mount_option_dev_shm_nosuidAdd nosuid Option to /dev/shm
• mount_option_nodev_nonroot_local_partitionsAdd nodev Option to Non-Root Local Partitions
• mount_option_tmp_nodevAdd nodev Option to /tmp
• mount_option_tmp_nosuidAdd nosuid Option to /tmp
• mount_option_var_log_audit_nodevAdd nodev Option to /var/log/audit
• mount_option_var_log_audit_noexecAdd noexec Option to /var/log/audit
• mount_option_var_log_audit_nosuidAdd nosuid Option to /var/log/audit
• mount_option_var_log_nodevAdd nodev Option to /var/log
• mount_option_var_log_noexecAdd noexec Option to /var/log
• mount_option_var_log_nosuidAdd nosuid Option to /var/log
• mount_option_var_nodevAdd nodev Option to /var
• mount_option_var_tmp_noexecAdd noexec Option to /var/tmp
• mount_option_var_tmp_nosuidAdd nosuid Option to /var/tmp
• SRG-OS-000373
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• SRG-OS-000373-GPOS-00156
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• SRG-OS-000373-GPOS-00157
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• SRG-OS-000373-GPOS-00158
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• SRG-OS-000375-GPOS-00160
• service_pcscd_enabledEnable the pcscd Service
• SRG-OS-000378-GPOS-00163
• package_usbguard_installedInstall usbguard Package
• SRG-OS-000383-GPOS-00166
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• sssd_ssh_known_hosts_timeoutConfigure SSSD to Expire SSH Known Hosts
• SRG-OS-000392-GPOS-00172
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• SRG-OS-000393-GPOS-00173
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• SRG-OS-000394-GPOS-00174
• harden_ssh_client_crypto_policyHarden SSH client Crypto Policy
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000396-GPOS-00176
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• SRG-OS-000423-GPOS-00187
• package_openssh-server_installedInstall the OpenSSH Server Package
• SRG-OS-000424-GPOS-00188
• package_openssh-server_installedInstall the OpenSSH Server Package
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• SRG-OS-000425-GPOS-00189
• package_openssh-server_installedInstall the OpenSSH Server Package
• SRG-OS-000426-GPOS-00190
• package_openssh-server_installedInstall the OpenSSH Server Package
• SRG-OS-000445-GPOS-00199
• package_libcap-ng-utils_installedInstall libcap-ng-utils Package
• SRG-OS-000458-GPOS-00203
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• SRG-OS-000461-GPOS-00205
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• SRG-OS-000462-GPOS-00206
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• SRG-OS-000466-GPOS-00210
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• SRG-OS-000467-GPOS-00210
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• SRG-OS-000468-GPOS-00212
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• SRG-OS-000470-GPOS-00214
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• SRG-OS-000471-GPOS-00215
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• SRG-OS-000473-GPOS-00218
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• SRG-OS-000476-GPOS-00221
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• SRG-OS-000478-GPOS-00223
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• SRG-OS-000479-GPOS-00224
• auditd_name_formatSet hostname as computer node name in audit logs
• package_rsyslog_installedEnsure rsyslog is Installed
• SRG-OS-000480-GPOS-00226
• accounts_logon_fail_delayEnsure the Logon Failure Delay is Set Correctly in login.defs
• SRG-OS-000480-GPOS-00227
• auditd_data_retention_flushConfigure auditd flush priority
• auditd_write_logsWrite Audit Logs to the Disk
• coredump_disable_backtracesDisable core dump backtraces
• coredump_disable_storageDisable storing core dump
• disable_ctrlaltdel_rebootDisable Ctrl-Alt-Del Reboot Activation
• file_groupowner_cron_dVerify Group Who Owns cron.d
• file_groupowner_cron_dailyVerify Group Who Owns cron.daily
• file_groupowner_cron_hourlyVerify Group Who Owns cron.hourly
• file_groupowner_cron_monthlyVerify Group Who Owns cron.monthly
• file_groupowner_cron_weeklyVerify Group Who Owns cron.weekly
• file_groupowner_crontabVerify Group Who Owns Crontab
• file_groupowner_sshd_configVerify Group Who Owns SSH Server config file
• file_owner_cron_dVerify Owner on cron.d
• file_owner_cron_dailyVerify Owner on cron.daily
• file_owner_cron_hourlyVerify Owner on cron.hourly
• file_owner_cron_monthlyVerify Owner on cron.monthly
• file_owner_cron_weeklyVerify Owner on cron.weekly
• file_owner_crontabVerify Owner on crontab
• file_owner_sshd_configVerify Owner on SSH Server config file
• file_permissions_cron_dVerify Permissions on cron.d
• file_permissions_cron_dailyVerify Permissions on cron.daily
• file_permissions_cron_hourlyVerify Permissions on cron.hourly
• file_permissions_cron_monthlyVerify Permissions on cron.monthly
• file_permissions_cron_weeklyVerify Permissions on cron.weekly
• file_permissions_crontabVerify Permissions on crontab
• file_permissions_sshd_configVerify Permissions on SSH Server config file
• file_permissions_sshd_private_keyVerify Permissions on SSH Server Private *_key Key Files
• file_permissions_sshd_pub_keyVerify Permissions on SSH Server Public *.pub Key Files
• file_permissions_ungroupownedEnsure All Files Are Owned by a Group
• installed_OS_is_vendor_supportedThe Installed Operating System Is Vendor Supported
• mount_option_nosuid_removable_partitionsAdd nosuid Option to Removable Media Partitions
• network_sniffer_disabledEnsure System is Not Acting as a Network Sniffer
• no_files_unowned_by_userEnsure All Files Are Owned by a User
• package_audit_installedEnsure the audit Subsystem is Installed
• package_gnutls-utils_installedEnsure gnutls-utils is installed
• package_iptables_installedInstall iptables Package
• package_nss-tools_installedEnsure nss-tools is installed
• package_openscap-scanner_installedInstall openscap-scanner Package
• package_policycoreutils_installedInstall policycoreutils Package
• package_rng-tools_installedInstall rng-tools Package
• package_rsyslog-gnutls_installedEnsure rsyslog-gnutls is installed
• package_scap-security-guide_installedInstall scap-security-guide Package
• package_sssd-ipa_installedInstall sssd-ipa Package
• package_vsftpd_removedUninstall vsftpd Package
• rsyslog_nolistenEnsure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
• service_kdump_disabledDisable KDump Kernel Crash Analyzer (kdump)
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_rhosts_rsaDisable SSH Support for Rhosts RSA Authentication
• sshd_disable_user_known_hostsDisable SSH Support for User Known Hosts
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_enable_x11_forwardingEnable Encrypted X11 Forwarding
• sshd_rekey_limitForce frequent session key renegotiation
• sshd_use_priv_separationEnable Use of Privilege Separation
• sysctl_kernel_kexec_load_disabledDisable Kernel Image Loading
• sysctl_net_ipv6_conf_all_accept_raConfigure Accepting Router Advertisements on All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv6 Interfaces
• sysctl_net_ipv6_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
• sysctl_net_ipv6_conf_default_accept_raDisable Accepting Router Advertisements on all IPv6 Interfaces by Default
• sysctl_net_ipv6_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
• SRG-OS-000480-GPOS-00229
• gnome_gdm_disable_automatic_loginDisable GDM Automatic Login
• gnome_gdm_disable_guest_loginDisable GDM Guest Login
• SRG-OS-00270
• install_antivirusInstall Virus Scanning Software
• SRG-OS-999999
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• accounts_password_warn_age_login_defsSet Password Warning Age
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• disable_users_coredumpsDisable Core Dumps for All Users
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• file_groupowner_etc_groupVerify Group Who Owns group File
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• file_owner_etc_groupVerify User Who Owns group File
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• file_owner_etc_passwdVerify User Who Owns passwd File
• file_owner_etc_shadowVerify User Who Owns shadow File
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• file_permissions_etc_groupVerify Permissions on group File
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• file_permissions_etc_passwdVerify Permissions on passwd File
• file_permissions_etc_shadowVerify Permissions on shadow File
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• gconf_gdm_disable_user_listDisable the User List
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• mount_option_smb_client_signingRequire Client SMB Packet Signing, if using mount.cifs
• mount_option_tmp_noexecAdd noexec Option to /tmp
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
• package_openldap-servers_removedUninstall openldap-servers Package
• package_sendmail_removedUninstall Sendmail Package
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• partition_for_homeEnsure /home Located On Separate Partition
• partition_for_tmpEnsure /tmp Located On Separate Partition
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_logEnsure /var/log Located On Separate Partition
• postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
• require_smb_client_signingRequire Client SMB Packet Signing, if using smbclient
• rpm_verify_hashesVerify File Hashes with RPM
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• selinux_policytypeConfigure SELinux Policy
• selinux_stateEnsure SELinux State is Enforcing
• service_autofs_disabledDisable the Automounter
• service_avahi-daemon_disabledDisable Avahi Server Software
• service_crond_enabledEnable cron Service
• service_postfix_enabledEnable Postfix Service
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• snmpd_use_newer_protocolConfigure SNMP Service to Use Only SNMPv3 or Newer
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• umask_for_daemonsSet Daemon Umask
• stigid
• RHEL-06-000001
• partition_for_tmpEnsure /tmp Located On Separate Partition
• RHEL-06-000002
• partition_for_varEnsure /var Located On Separate Partition
• RHEL-06-000003
• partition_for_var_logEnsure /var/log Located On Separate Partition
• RHEL-06-000004
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• RHEL-06-000005
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• RHEL-06-000007
• partition_for_homeEnsure /home Located On Separate Partition
• RHEL-06-000008
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• RHEL-06-000009
• service_rhnsd_disabledDisable Red Hat Network Service (rhnsd)
• RHEL-06-000011
• security_patches_up_to_dateEnsure Software Patches Installed
• RHEL-06-000013
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• RHEL-06-000015
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• RHEL-06-000016
• package_aide_installedInstall AIDE
• RHEL-06-000017
• grub_legacy_enable_selinuxEnsure SELinux Not Disabled in /etc/grub.conf
• RHEL-06-000018
• aide_build_databaseBuild and Test AIDE Database
• RHEL-06-000019
• no_rsh_trust_filesRemove Rsh Trust Files
• RHEL-06-000020
• selinux_stateEnsure SELinux State is Enforcing
• RHEL-06-000023
• selinux_policytypeConfigure SELinux Policy
• RHEL-06-000025
• selinux_all_devicefiles_labeledEnsure No Device Files are Unlabeled by SELinux
• RHEL-06-000027
• securetty_root_login_console_onlyRestrict Virtual Console Root Logins
• RHEL-06-000028
• restrict_serial_port_loginsRestrict Serial Port Root Logins
• RHEL-06-000029
• no_password_auth_for_systemaccountsEnsure that System Accounts Are Locked
• RHEL-06-000030
• no_empty_passwordsPrevent Login to Accounts With Empty Password
• RHEL-06-000031
• accounts_password_all_shadowedVerify All Account Password Hashes are Shadowed
• RHEL-06-000032
• accounts_no_uid_except_zeroVerify Only Root Has UID 0
• RHEL-06-000033
• file_owner_etc_shadowVerify User Who Owns shadow File
• RHEL-06-000034
• file_groupowner_etc_shadowVerify Group Who Owns shadow File
• RHEL-06-000035
• file_permissions_etc_shadowVerify Permissions on shadow File
• RHEL-06-000036
• file_owner_etc_gshadowVerify User Who Owns gshadow File
• RHEL-06-000037
• file_groupowner_etc_gshadowVerify Group Who Owns gshadow File
• RHEL-06-000038
• file_permissions_etc_gshadowVerify Permissions on gshadow File
• RHEL-06-000039
• file_owner_etc_passwdVerify User Who Owns passwd File
• RHEL-06-000040
• file_groupowner_etc_passwdVerify Group Who Owns passwd File
• RHEL-06-000041
• file_permissions_etc_passwdVerify Permissions on passwd File
• RHEL-06-000042
• file_owner_etc_groupVerify User Who Owns group File
• RHEL-06-000043
• file_groupowner_etc_groupVerify Group Who Owns group File
• RHEL-06-000044
• file_permissions_etc_groupVerify Permissions on group File
• RHEL-06-000045
• file_permissions_library_dirsVerify that Shared Library Files Have Restrictive Permissions
• RHEL-06-000046
• file_ownership_library_dirsVerify that Shared Library Files Have Root Ownership
• RHEL-06-000047
• file_permissions_binary_dirsVerify that System Executables Have Restrictive Permissions
• RHEL-06-000048
• file_ownership_binary_dirsVerify that System Executables Have Root Ownership
• RHEL-06-000050
• accounts_password_minlen_login_defsSet Password Minimum Length in login.defs
• RHEL-06-000051
• accounts_minimum_age_login_defsSet Password Minimum Age
• RHEL-06-000053
• accounts_maximum_age_login_defsSet Password Maximum Age
• RHEL-06-000054
• accounts_password_warn_age_login_defsSet Password Warning Age
• RHEL-06-000056
• cracklib_accounts_password_pam_dcreditSet Password Strength Minimum Digit Characters
• RHEL-06-000057
• cracklib_accounts_password_pam_ucreditSet Password Strength Minimum Uppercase Characters
• RHEL-06-000058
• cracklib_accounts_password_pam_ocreditSet Password Strength Minimum Special Characters
• RHEL-06-000059
• cracklib_accounts_password_pam_lcreditSet Password Strength Minimum Lowercase Characters
• RHEL-06-000060
• cracklib_accounts_password_pam_difokSet Password Strength Minimum Different Characters
• RHEL-06-000061
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• RHEL-06-000062
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• RHEL-06-000063
• set_password_hashing_algorithm_logindefsSet Password Hashing Algorithm in /etc/login.defs
• RHEL-06-000064
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• RHEL-06-000065
• file_owner_grub_confVerify /etc/grub.conf User Ownership
• RHEL-06-000066
• file_groupowner_grub_confVerify /etc/grub.conf Group Ownership
• RHEL-06-000067
• file_permissions_grub_confVerify /boot/grub/grub.conf Permissions
• RHEL-06-000068
• grub_legacy_passwordSet Boot Loader Password in grub.conf
• RHEL-06-000069
• require_singleuser_authRequire Authentication for Single User Mode
• RHEL-06-000070
• grub_legacy_disable_interactive_bootDisable Interactive Boot
• RHEL-06-000071
• package_screen_installedInstall the screen Package
• RHEL-06-000073
• banner_etc_issueModify the System Login Banner
• RHEL-06-000078
• sysctl_kernel_randomize_va_spaceEnable Randomized Layout of Virtual Address Space
• RHEL-06-000079
• sysctl_kernel_exec_shieldEnable ExecShield via sysctl
• RHEL-06-000080
• sysctl_net_ipv4_conf_default_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
• RHEL-06-000081
• sysctl_net_ipv4_conf_all_send_redirectsDisable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
• RHEL-06-000082
• sysctl_net_ipv4_ip_forwardDisable Kernel Parameter for IP Forwarding on IPv4 Interfaces
• RHEL-06-000083
• sysctl_net_ipv4_conf_all_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
• RHEL-06-000084
• sysctl_net_ipv4_conf_all_accept_redirectsDisable Accepting ICMP Redirects for All IPv4 Interfaces
• RHEL-06-000086
• sysctl_net_ipv4_conf_all_secure_redirectsDisable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
• RHEL-06-000088
• sysctl_net_ipv4_conf_all_log_martiansEnable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• RHEL-06-000089
• sysctl_net_ipv4_conf_default_accept_source_routeDisable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
• RHEL-06-000090
• sysctl_net_ipv4_conf_default_secure_redirectsConfigure Kernel Parameter for Accepting Secure Redirects By Default
• RHEL-06-000091
• sysctl_net_ipv4_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
• RHEL-06-000092
• sysctl_net_ipv4_icmp_echo_ignore_broadcastsEnable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
• RHEL-06-000093
• sysctl_net_ipv4_icmp_ignore_bogus_error_responsesEnable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
• RHEL-06-000095
• sysctl_net_ipv4_tcp_syncookiesEnable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces
• RHEL-06-000096
• sysctl_net_ipv4_conf_all_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
• RHEL-06-000097
• sysctl_net_ipv4_conf_default_rp_filterEnable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
• RHEL-06-000098
• kernel_module_ipv6_option_disabledDisable IPv6 Networking Support Automatic Loading
• RHEL-06-000099
• sysctl_net_ipv6_conf_default_accept_redirectsDisable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
• RHEL-06-000103
• service_ip6tables_enabledVerify ip6tables Enabled if Using IPv6
• RHEL-06-000117
• service_iptables_enabledVerify iptables Enabled
• RHEL-06-000120
• set_iptables_default_ruleSet Default iptables Policy for Incoming Packets
• RHEL-06-000124
• kernel_module_dccp_disabledDisable DCCP Support
• RHEL-06-000125
• kernel_module_sctp_disabledDisable SCTP Support
• RHEL-06-000126
• kernel_module_rds_disabledDisable RDS Support
• RHEL-06-000127
• kernel_module_tipc_disabledDisable TIPC Support
• RHEL-06-000133
• rsyslog_files_ownershipEnsure Log Files Are Owned By Appropriate User
• RHEL-06-000134
• rsyslog_files_groupownershipEnsure Log Files Are Owned By Appropriate Group
• RHEL-06-000135
• rsyslog_files_permissionsEnsure System Log Files Have Correct Permissions
• RHEL-06-000136
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• RHEL-06-000138
• ensure_logrotate_activatedEnsure Logrotate Runs Periodically
• RHEL-06-000145
• service_auditd_enabledEnable auditd Service
• RHEL-06-000159
• auditd_data_retention_num_logsConfigure auditd Number of Logs Retained
• RHEL-06-000160
• auditd_data_retention_max_log_fileConfigure auditd Max Log File Size
• RHEL-06-000161
• auditd_data_retention_max_log_file_actionConfigure auditd max_log_file_action Upon Reaching Maximum Log Size
• RHEL-06-000163
• auditd_data_retention_admin_space_left_actionConfigure auditd admin_space_left Action on Low Disk Space
• RHEL-06-000165
• audit_rules_time_adjtimexRecord attempts to alter time through adjtimex
• RHEL-06-000167
• audit_rules_time_settimeofdayRecord attempts to alter time through settimeofday
• RHEL-06-000169
• audit_rules_time_stimeRecord Attempts to Alter Time Through stime
• RHEL-06-000171
• audit_rules_time_clock_settimeRecord Attempts to Alter Time Through clock_settime
• RHEL-06-000173
• audit_rules_time_watch_localtimeRecord Attempts to Alter the localtime File
• RHEL-06-000174
• audit_rules_usergroup_modificationRecord Events that Modify User/Group Information
• RHEL-06-000182
• audit_rules_networkconfig_modificationRecord Events that Modify the System's Network Environment
• RHEL-06-000183
• audit_rules_mac_modificationRecord Events that Modify the System's Mandatory Access Controls
• RHEL-06-000184
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• RHEL-06-000185
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• RHEL-06-000186
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• RHEL-06-000187
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• RHEL-06-000188
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• RHEL-06-000189
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• RHEL-06-000190
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• RHEL-06-000191
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• RHEL-06-000192
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• RHEL-06-000193
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• RHEL-06-000194
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• RHEL-06-000195
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• RHEL-06-000196
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• RHEL-06-000197
• audit_rules_unsuccessful_file_modificationEnsure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
• RHEL-06-000198
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• RHEL-06-000199
• audit_rules_media_exportEnsure auditd Collects Information on Exporting to Media (successful)
• RHEL-06-000200
• audit_rules_file_deletion_eventsEnsure auditd Collects File Deletion Events by User
• RHEL-06-000201
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• RHEL-06-000202
• audit_rules_kernel_module_loadingEnsure auditd Collects Information on Kernel Module Loading and Unloading
• RHEL-06-000203
• service_xinetd_disabledDisable xinetd Service
• RHEL-06-000204
• package_xinetd_removedUninstall xinetd Package
• RHEL-06-000206
• package_telnet-server_removedUninstall telnet-server Package
• RHEL-06-000211
• service_telnet_disabledDisable telnet Service
• RHEL-06-000213
• package_rsh-server_removedUninstall rsh-server Package
• RHEL-06-000214
• service_rsh_disabledDisable rsh Service
• RHEL-06-000216
• service_rexec_disabledDisable rexec Service
• RHEL-06-000218
• service_rlogin_disabledDisable rlogin Service
• RHEL-06-000220
• package_ypserv_removedUninstall ypserv Package
• RHEL-06-000221
• service_ypbind_disabledDisable ypbind Service
• RHEL-06-000222
• package_tftp-server_removedUninstall tftp-server Package
• RHEL-06-000223
• service_tftp_disabledDisable tftp Service
• RHEL-06-000224
• service_crond_enabledEnable cron Service
• RHEL-06-000227
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• RHEL-06-000230
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• RHEL-06-000231
• sshd_set_keepaliveSet SSH Client Alive Max Count
• RHEL-06-000234
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• RHEL-06-000236
• disable_host_authDisable Host-Based Authentication
• RHEL-06-000237
• sshd_disable_root_loginDisable SSH Root Login
• RHEL-06-000239
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• RHEL-06-000240
• sshd_enable_warning_bannerEnable SSH Warning Banner
• RHEL-06-000241
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• RHEL-06-000243
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• RHEL-06-000246
• service_avahi-daemon_disabledDisable Avahi Server Software
• RHEL-06-000247
• service_ntpd_enabledEnable the NTP Daemon
• RHEL-06-000248
• ntpd_specify_remote_serverSpecify a Remote NTP Server
• RHEL-06-000249
• postfix_network_listening_disabledDisable Postfix Network Listening
• RHEL-06-000252
• ldap_client_start_tlsConfigure LDAP Client to Use TLS For All Transactions
• RHEL-06-000253
• ldap_client_tls_cacertpathConfigure Certificate Directives for LDAP Use of TLS
• RHEL-06-000256
• package_openldap-servers_removedUninstall openldap-servers Package
• RHEL-06-000257
• gconf_gnome_screensaver_idle_delaySet GNOME Login Inactivity Timeout
• RHEL-06-000258
• gconf_gnome_screensaver_idle_activation_enabledGNOME Desktop Screensaver Mandatory Use
• RHEL-06-000259
• gconf_gnome_screensaver_lock_enabledEnable Screen Lock Activation After Idle Period
• RHEL-06-000260
• gconf_gnome_screensaver_mode_blankImplement Blank Screensaver
• RHEL-06-000261
• service_abrtd_disabledDisable Automatic Bug Reporting Tool (abrtd)
• RHEL-06-000262
• service_atd_disabledDisable At Service (atd)
• RHEL-06-000265
• service_ntpdate_disabledDisable ntpdate Service (ntpdate)
• RHEL-06-000266
• service_oddjobd_disabledDisable Odd Job Daemon (oddjobd)
• RHEL-06-000267
• service_qpidd_disabledDisable Apache Qpid (qpidd)
• RHEL-06-000268
• service_rdisc_disabledDisable Network Router Discovery Daemon (rdisc)
• RHEL-06-000269
• mount_option_nodev_remote_filesystemsMount Remote Filesystems with nodev
• RHEL-06-000270
• mount_option_nosuid_remote_filesystemsMount Remote Filesystems with nosuid
• RHEL-06-000271
• mount_option_noexec_removable_partitionsAdd noexec Option to Removable Media Partitions
• RHEL-06-000272
• require_smb_client_signingRequire Client SMB Packet Signing, if using smbclient
• RHEL-06-000273
• mount_option_smb_client_signingRequire Client SMB Packet Signing, if using mount.cifs
• RHEL-06-000274
• accounts_password_pam_unix_rememberLimit Password Reuse
• RHEL-06-000275
• encrypt_partitionsEncrypt Partitions
• RHEL-06-000279
• rpm_verify_ownershipVerify and Correct Ownership with RPM
• RHEL-06-000282
• file_permissions_unauthorized_world_writableEnsure No World-Writable Files Exist
• RHEL-06-000284
• install_antivirusInstall Virus Scanning Software
• RHEL-06-000285
• install_hidsInstall Intrusion Detection Software
• RHEL-06-000287
• service_postfix_enabledEnable Postfix Service
• RHEL-06-000288
• package_sendmail_removedUninstall Sendmail Package
• RHEL-06-000289
• service_netconsole_disabledDisable Network Console (netconsole)
• RHEL-06-000290
• xwindows_runlevel_settingDisable X Windows Startup By Setting Runlevel
• RHEL-06-000291
• package_xorg-x11-server-common_removedRemove the X Windows Package Group
• RHEL-06-000292
• sysconfig_networking_bootproto_ifcfgDisable DHCP Client in ifcfg
• RHEL-06-000293
• wireless_disable_interfacesDeactivate Wireless Network Interfaces
• RHEL-06-000294
• gid_passwd_group_sameAll GIDs referenced in /etc/passwd must be defined in /etc/group
• RHEL-06-000296
• account_unique_nameEnsure All Accounts on the System Have Unique Names
• RHEL-06-000297
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• RHEL-06-000299
• cracklib_accounts_password_pam_maxrepeatSet Password to Maximum of Three Consecutive Repeating Characters
• RHEL-06-000306
• aide_periodic_cron_checkingConfigure Periodic Execution of AIDE
• RHEL-06-000308
• disable_users_coredumpsDisable Core Dumps for All Users
• RHEL-06-000309
• no_insecure_locks_exportsEnsure Insecure File Locking is Not Allowed
• RHEL-06-000311
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• RHEL-06-000313
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• RHEL-06-000315
• kernel_module_bluetooth_disabledDisable Bluetooth Kernel Module
• RHEL-06-000319
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• RHEL-06-000320
• set_iptables_default_rule_forwardSet Default iptables Policy for Forwarded Packets
• RHEL-06-000321
• package_libreswan_installedInstall libreswan Package
• RHEL-06-000324
• gconf_gdm_enable_warning_gui_bannerEnable GUI Warning Banner
• RHEL-06-000326
• gconf_gdm_set_login_banner_textSet GUI Warning Banner Text
• RHEL-06-000331
• service_bluetooth_disabledDisable Bluetooth Service
• RHEL-06-000334
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• RHEL-06-000336
• dir_perms_world_writable_sticky_bitsVerify that All World-Writable Directories Have Sticky Bits Set
• RHEL-06-000337
• dir_perms_world_writable_system_ownedEnsure All World-Writable Directories Are Owned by a System Account
• RHEL-06-000338
• tftpd_uses_secure_modeEnsure tftp Daemon Uses Secure Mode
• RHEL-06-000339
• ftp_log_transactionsEnable Logging of All FTP Transactions
• RHEL-06-000340
• snmpd_use_newer_protocolConfigure SNMP Service to Use Only SNMPv3 or Newer
• RHEL-06-000341
• snmpd_not_default_passwordEnsure Default SNMP Password Is Not Used
• RHEL-06-000342
• accounts_umask_etc_bashrcEnsure the Default Bash Umask is Set Correctly
• RHEL-06-000343
• accounts_umask_etc_csh_cshrcEnsure the Default C Shell Umask is Set Correctly
• RHEL-06-000344
• accounts_umask_etc_profileEnsure the Default Umask is Set Correctly in /etc/profile
• RHEL-06-000345
• accounts_umask_etc_login_defsEnsure the Default Umask is Set Correctly in login.defs
• RHEL-06-000346
• umask_for_daemonsSet Daemon Umask
• RHEL-06-000347
• no_netrc_filesVerify No netrc Files Exist
• RHEL-06-000348
• ftp_present_bannerCreate Warning Banners for All FTP Users
• RHEL-06-000349
• smartcard_authEnable Smart Card Login
• RHEL-06-000356
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• RHEL-06-000357
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• RHEL-06-000372
• display_login_attemptsEnsure PAM Displays Last Logon/Access Notification
• RHEL-06-000383
• file_permissions_var_log_auditSystem Audit Logs Must Have Mode 0640 or Less Permissive
• RHEL-06-000384
• file_ownership_var_log_auditSystem Audit Logs Must Be Owned By Root
• RHEL-06-000385
• directory_permissions_var_log_auditSystem Audit Logs Must Have Mode 0750 or Less Permissive
• RHEL-06-000503
• kernel_module_usb-storage_disabledDisable Modprobe Loading of USB Storage Driver
• RHEL-06-000504
• configure_user_data_backupsConfigure Backups of User Data
• RHEL-06-000507
• sshd_print_last_logEnable SSH Print Last Log
• RHEL-06-000508
• gconf_gnome_screen_locking_keybindingsSet GNOME Screen Locking Keybindings
• RHEL-06-000509
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• RHEL-06-000510
• auditd_data_disk_full_actionConfigure auditd Disk Full Action when Disk Space Is Full
• RHEL-06-000511
• auditd_data_disk_error_actionConfigure auditd Disk Error Action on Disk Error
• RHEL-06-000515
• no_all_squash_exportsEnsure All-Squashing Disabled On All Exports
• RHEL-06-000518
• rpm_verify_permissionsVerify and Correct File Permissions with RPM
• RHEL-06-000519
• rpm_verify_hashesVerify File Hashes with RPM
• RHEL-06-000521
• postfix_client_configure_mail_aliasConfigure System to Forward All Mail For The Root Account
• RHEL-06-000523
• set_ip6tables_default_ruleSet Default ip6tables Policy for Incoming Packets
• RHEL-06-000524
• account_use_centralized_automated_authUse Centralized and Automated Authentication
• RHEL-06-000525
• grub_legacy_audit_argumentEnable Auditing for Processes Which Start Prior to the Audit Daemon
• RHEL-06-000526
• service_autofs_disabledDisable the Automounter
• RHEL-06-000527
• gconf_gdm_disable_user_listDisable the User List
• RHEL-06-000528
• mount_option_tmp_noexecAdd noexec Option to /tmp
• RHEL-06-000529
• sudo_require_authenticationEnsure Users Re-Authenticate for Privilege Escalation - sudo
• WG610
• httpd_configure_firewallConfigure firewall to Allow Access to the Web Server
• vmmsrg
• SRG-OS-000002-VMM-000020
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• SRG-OS-000003-VMM-000030
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• SRG-OS-000004-VMM-000040
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000021-VMM-000050
• accounts_passwords_pam_faillock_denySet Deny For Failed Password Attempts
• accounts_passwords_pam_faillock_intervalSet Interval For Counting Failed Password Attempts
• SRG-OS-000023-VMM-000060
• banner_etc_issueModify the System Login Banner
• sshd_enable_warning_bannerEnable SSH Warning Banner
• SRG-OS-000024-VMM-000070
• banner_etc_issueModify the System Login Banner
• sshd_enable_warning_bannerEnable SSH Warning Banner
• SRG-OS-000027-VMM-000080
• accounts_max_concurrent_login_sessionsLimit the Number of Concurrent Login Sessions Allowed Per User
• SRG-OS-000030-VMM-000110
• package_screen_installedInstall the screen Package
• SRG-OS-000032-VMM-000130
• rsyslog_remote_loghostEnsure Logs Sent To Remote Host
• SRG-OS-000033-VMM-000140
• sshd_allow_only_protocol2Allow Only SSH Protocol 2
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000037-VMM-000150
• service_auditd_enabledEnable auditd Service
• SRG-OS-000038-VMM-000160
• service_auditd_enabledEnable auditd Service
• SRG-OS-000039-VMM-000170
• service_auditd_enabledEnable auditd Service
• SRG-OS-000040-VMM-000180
• service_auditd_enabledEnable auditd Service
• SRG-OS-000041-VMM-000190
• service_auditd_enabledEnable auditd Service
• SRG-OS-000046-VMM-000210
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• SRG-OS-000051-VMM-000230
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• SRG-OS-000058-VMM-000270
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• SRG-OS-000059-VMM-000280
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• SRG-OS-000063-VMM-000310
• service_auditd_enabledEnable auditd Service
• SRG-OS-000077-VMM-000440
• accounts_password_pam_unix_rememberLimit Password Reuse
• SRG-OS-000107-VMM-000530
• sshd_disable_rhostsDisable SSH Support for .rhosts Files
• SRG-OS-000118-VMM-000590
• account_disable_post_pw_expirationSet Account Expiration Following Inactivity
• SRG-OS-000120-VMM-000600
• disable_prelinkDisable Prelinking
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000123-VMM-000620
• account_temp_expire_dateAssign Expiration Date to Temporary Accounts
• SRG-OS-000163-VMM-000700
• accounts_tmoutSet Interactive Session Timeout
• SRG-OS-000239-VMM-000810
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000240-VMM-000820
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000241-VMM-000830
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000274-VMM-000960
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000275-VMM-000970
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000276-VMM-000980
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000277-VMM-000990
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000279-VMM-001010
• accounts_tmoutSet Interactive Session Timeout
• SRG-OS-000303-VMM-001090
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000304-VMM-001100
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000329-VMM-001180
• accounts_passwords_pam_faillock_unlock_timeSet Lockout Time for Failed Password Attempts
• SRG-OS-000341-VMM-001220
• partition_for_varEnsure /var Located On Separate Partition
• partition_for_var_log_auditEnsure /var/log/audit Located On Separate Partition
• SRG-OS-000343-VMM-001240
• auditd_data_retention_action_mail_acctConfigure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_space_leftConfigure auditd space_left on Low Disk Space
• auditd_data_retention_space_left_actionConfigure auditd space_left Action on Low Disk Space
• SRG-OS-000366-VMM-001430
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• SRG-OS-000370-VMM-001460
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• SRG-OS-000377-VMM-001530
• service_pcscd_enabledEnable the pcscd Service
• SRG-OS-000383-VMM-001570
• sssd_memcache_timeoutConfigure SSSD's Memory Cache to Expire
• sssd_offline_cred_expirationConfigure SSSD to Expire Offline Credentials
• SRG-OS-000396-VMM-001590
• disable_prelinkDisable Prelinking
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000404-VMM-001650
• encrypt_partitionsEncrypt Partitions
• ensure_gpgcheck_globally_activatedEnsure gpgcheck Enabled In Main yum Configuration
• ensure_gpgcheck_never_disabledEnsure gpgcheck Enabled for All yum Package Repositories
• ensure_redhat_gpgkey_installedEnsure Red Hat GPG Key Installed
• SRG-OS-000405-VMM-001660
• encrypt_partitionsEncrypt Partitions
• SRG-OS-000445-VMM-001780
• selinux_policytypeConfigure SELinux Policy
• SRG-OS-000458-VMM-001810
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
• audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
• audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
• audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
• audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
• audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
• audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
• audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
• audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• SRG-OS-000461-VMM-001830
• audit_rules_unsuccessful_file_modification_chmodRecord Unsuccessul Permission Changes to Files - chmod
• audit_rules_unsuccessful_file_modification_chownRecord Unsuccessul Ownership Changes to Files - chown
• audit_rules_unsuccessful_file_modification_creatRecord Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_fchmodRecord Unsuccessul Permission Changes to Files - fchmod
• audit_rules_unsuccessful_file_modification_fchmodatRecord Unsuccessul Permission Changes to Files - fchmodat
• audit_rules_unsuccessful_file_modification_fchownRecord Unsuccessul Ownership Changes to Files - fchown
• audit_rules_unsuccessful_file_modification_fchownatRecord Unsuccessul Ownership Changes to Files - fchownat
• audit_rules_unsuccessful_file_modification_fremovexattrRecord Unsuccessul Permission Changes to Files - fremovexattr
• audit_rules_unsuccessful_file_modification_fsetxattrRecord Unsuccessul Permission Changes to Files - fsetxattr
• audit_rules_unsuccessful_file_modification_ftruncateRecord Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_lchownRecord Unsuccessul Ownership Changes to Files - lchown
• audit_rules_unsuccessful_file_modification_lremovexattrRecord Unsuccessul Permission Changes to Files - lremovexattr
• audit_rules_unsuccessful_file_modification_lsetxattrRecord Unsuccessul Permission Changes to Files - lsetxattr
• audit_rules_unsuccessful_file_modification_openRecord Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_open_by_handle_atRecord Unsuccessful Access Attempts to Files - open_by_handle_at
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creatRecord Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT
• audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_open_o_creatRecord Unsuccessful Creation Attempts to Files - open O_CREAT
• audit_rules_unsuccessful_file_modification_open_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_openatRecord Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_openat_o_creatRecord Unsuccessful Creation Attempts to Files - openat O_CREAT
• audit_rules_unsuccessful_file_modification_openat_o_trunc_writeRecord Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE
• audit_rules_unsuccessful_file_modification_removexattrRecord Unsuccessul Permission Changes to Files - removexattr
• audit_rules_unsuccessful_file_modification_renameRecord Unsuccessul Delete Attempts to Files - rename
• audit_rules_unsuccessful_file_modification_renameatRecord Unsuccessul Delete Attempts to Files - renameat
• audit_rules_unsuccessful_file_modification_setxattrRecord Unsuccessul Permission Changes to Files - setxattr
• audit_rules_unsuccessful_file_modification_truncateRecord Unsuccessful Access Attempts to Files - truncate
• audit_rules_unsuccessful_file_modification_unlinkRecord Unsuccessul Delete Attempts to Files - unlink
• audit_rules_unsuccessful_file_modification_unlinkatRecord Unsuccessul Delete Attempts to Files - unlinkat
• SRG-OS-000462-VMM-001840
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• SRG-OS-000466-VMM-001870
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• SRG-OS-000468-VMM-001890
• audit_rules_file_deletion_events_renameEnsure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameatEnsure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_rmdirEnsure auditd Collects File Deletion Events by User - rmdir
• audit_rules_file_deletion_events_unlinkEnsure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkatEnsure auditd Collects File Deletion Events by User - unlinkat
• SRG-OS-000470-VMM-001900
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• SRG-OS-000471-VMM-001910
• audit_rules_privileged_commandsEnsure auditd Collects Information on the Use of Privileged Commands
• audit_rules_privileged_commands_crontabEnsure auditd Collects Information on the Use of Privileged Commands - crontab
• audit_rules_privileged_commands_gpasswdEnsure auditd Collects Information on the Use of Privileged Commands - gpasswd
• audit_rules_privileged_commands_mountEnsure auditd Collects Information on the Use of Privileged Commands - mount
• audit_rules_privileged_commands_newgidmapEnsure auditd Collects Information on the Use of Privileged Commands - newgidmap
• audit_rules_privileged_commands_newgrpEnsure auditd Collects Information on the Use of Privileged Commands - newgrp
• audit_rules_privileged_commands_newuidmapEnsure auditd Collects Information on the Use of Privileged Commands - newuidmap
• audit_rules_privileged_commands_passwdEnsure auditd Collects Information on the Use of Privileged Commands - passwd
• audit_rules_privileged_commands_umountEnsure auditd Collects Information on the Use of Privileged Commands - umount
• audit_rules_privileged_commands_unix_chkpwdEnsure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
• audit_rules_privileged_commands_userhelperEnsure auditd Collects Information on the Use of Privileged Commands - userhelper
• audit_rules_privileged_commands_usernetctlEnsure auditd Collects Information on the Use of Privileged Commands - usernetctl
• audit_rules_sysadmin_actionsEnsure auditd Collects System Administrator Actions
• SRG-OS-000473-VMM-001930
• audit_rules_login_events_faillockRecord Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlogRecord Attempts to Alter Logon and Logout Events - lastlog
• audit_rules_login_events_tallylogRecord Attempts to Alter Logon and Logout Events - tallylog
• SRG-OS-000474-VMM-001940
• audit_rules_dac_modification_chmodRecord Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_chownRecord Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchmodRecord Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodatRecord Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchownRecord Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownatRecord Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_fremovexattrRecord Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lchownRecord Events that Modify the System's Discretionary Access Controls - lchown
• audit_rules_dac_modification_lremovexattrRecord Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattrRecord Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattrRecord Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattrRecord Events that Modify the System's Discretionary Access Controls - setxattr
• SRG-OS-000476-VMM-001960
• audit_rules_usergroup_modification_groupRecord Events that Modify User/Group Information - /etc/group
• audit_rules_usergroup_modification_gshadowRecord Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_passwdRecord Events that Modify User/Group Information - /etc/passwd
• audit_rules_usergroup_modification_shadowRecord Events that Modify User/Group Information - /etc/shadow
• SRG-OS-000478-VMM-001980
• disable_prelinkDisable Prelinking
• installed_OS_is_FIPS_certifiedThe Installed Operating System Is FIPS 140-2 Certified
• package_dracut-fips-aesni_installedInstall the dracut-fips-aesni Package
• package_dracut-fips_installedInstall the dracut-fips Package
• sshd_use_approved_ciphersUse Only FIPS 140-2 Validated Ciphers
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• SRG-OS-000479-VMM-001990
• auditd_audispd_syslog_plugin_activatedConfigure auditd to use audispd's syslog plugin
• SRG-OS-000480-VMM-002000
• disable_host_authDisable Host-Based Authentication
• security_patches_up_to_dateEnsure Software Patches Installed
• service_snmpd_disabledDisable snmpd Service
• set_password_hashing_algorithm_libuserconfSet Password Hashing Algorithm in /etc/libuser.conf
• set_password_hashing_algorithm_systemauthSet PAM's Password Hashing Algorithm
• sshd_disable_compressionDisable Compression Or Set Compression to delayed
• sshd_disable_empty_passwordsDisable SSH Access via Empty Passwords
• sshd_disable_gssapi_authDisable GSSAPI Authentication
• sshd_disable_kerb_authDisable Kerberos Authentication
• sshd_disable_root_loginDisable SSH Root Login
• sshd_do_not_permit_user_envDo Not Allow SSH Environment Options
• sshd_enable_strictmodesEnable Use of Strict Mode Checking
• sshd_set_idle_timeoutSet SSH Idle Timeout Interval
• sshd_set_keepaliveSet SSH Client Alive Max Count
• sshd_use_approved_macsUse Only FIPS 140-2 Validated MACs
• vsrg
• SRG-OS-000373-VMM-001470
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• SRG-OS-000373-VMM-001480
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• SRG-OS-000373-VMM-001490
• sudo_remove_no_authenticateEnsure Users Re-Authenticate for Privilege Escalation - sudo !authenticate
• sudo_remove_nopasswdEnsure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD
• SRG-OS-000445-VMM-001780
• selinux_stateEnsure SELinux State is Enforcing